Cross-site scripting (XSS)
Also called: XSS
An attack where text a user enters is run as code in other people's browsers.
Definition
If a site shows user input without escaping it, someone can enter HTML or JavaScript that runs for every visitor. A basic manual check is entering text like <b>test</b> into fields and seeing whether it appears as bold text instead of plain characters.
In practice
A product review containing <b>Great</b> shows the word in bold. The page is rendering user input as HTML and should be reported.
Learn it in context
Lessons that use this term.