Glossary · Phase 7 · Software engineering
Cross-site scripting
An attack where text shown on a web page contains code that runs in visitors' browsers. Escaping the text prevents it.
Think of a community noticeboard. If a note could run down the street and pick visitors' pockets, you'd want it behind glass. If a web page shows a comment exactly as typed, a commenter can type HTML. A
<script>tag then runs in every visitor's browser, where it can steal their session. That's cross-site scripting (XSS), injection into a web page.
Try it now
Most attacks are the same mistake: data being treated as code.
Learn it properly
Secure coding · Injection, escaping, secrets and passwords: the mistakes attackers look for. About 40 minutes.
Other terms from the same lesson
- path traversal: An attack that uses ../ in a file name to reach files outside the folder an app meant to share.
- salt: A random value mixed into each password before hashing, so equal passwords get different hashes.
Never trained an AI?
Teach a small one to write, right in your browser. It takes about 20 seconds and needs no account.