Skip to content
Free public beta until December 4, 2026: every course is open, no card needed. After that, the first chapter of each course stays free and full access is a one-time $39 ($19 for up to 100 founding members chosen for helpful feedback). Your progress is kept. How the beta works

cross-site scripting

Getting a web page to run an attacker's script by sneaking it into content the page displays.

XSS injects script into a page through unencoded untrusted data; defenses are context-aware output encoding, avoiding raw HTML, and a Content-Security-Policy.

Loading interactive…

Examples

  • A product review of <script>stealCookies()</script> shown on the page without encoding runs in every visitor's browser.

See also

untrusted input SQL injection
Read the full section →