XSS (Cross-Site Scripting)

XSS (cross-site scripting) is a vulnerability in which a website includes untrusted input in a page without proper handling, so an attacker's script runs in other visitors' browsers with the site's privileges.

Why it matters

Injected script can read page data, act as the user, and steal session tokens that are not protected. The main defenses are output encoding for the right context, avoiding unsafe DOM methods, and a Content Security Policy that limits which scripts may run. HttpOnly cookies reduce what a script can steal.

Example

A comment box prints <script> content as raw HTML. Safe handling encodes it so the browser shows the text instead of running it:

<script>alert(1)</script>

Common mistakes

• Filtering input for bad words instead of encoding output.
• Using innerHTML with user-supplied data.
• Treating CSP as the only defense. It is a second layer, not a fix for the bug.

Related

• CSP
• CSRF
• SQL injection
• Session hijacking
• टूल: Security headers checker

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.