Preventing cross-site scripting

Cross-site scripting (XSS) occurs when a website accepts input crafted by an attacker and includes it in its pages without sanitizing it to remove or neutralize executable JavaScript. The browser's same-origin policy is meant to keep different sites' code isolated, but XSS subverts it by tricking the target site into executing malicious code within its own context, as though it were same-origin — letting the attacker modify page content, read local storage, or make HTTP requests with the user's credentials, enabling impersonation and access to sensitive operations such as financial transactions. A canonical mistake is assigning unsanitized input, such as a name taken from a URL parameter, to an element's innerHTML property, which interprets its value as HTML; an attacker can supply markup such as an img element with an onerror handler to run arbitrary code. Defense means treating every piece of user-supplied data as text rather than code: validate input and encode output so injected markup can never execute in the page's context. Scope: Web security. Reviewed October 4, 2026.