Cross-site scripting is an injection vulnerability in which untrusted content is interpreted as script in a user's trusted browser context.
XSS happens when an application places attacker-controlled input into a page without safely handling it, allowing code to run in another user's browser.
The browser trusts the page's origin, so injected script may access what that page can access.
Think of XSS like printing a visitor's unverified note directly onto an official noticeboard as if it were the board's own instruction.
Readers trust the board, so the note gains the board's authority.
XSS can change what users see, capture input, or perform actions available to the page.
Place unexpected HTML or script into rendered content.
Execute with the permissions of the trusted page.
Access page content available to the script.
Trigger page actions as the user when controls allow it.
XSS risk appears anywhere untrusted data is rendered into a browser page.
User posts are displayed to other visitors.
Query text is reflected into a page.
Formatted content is accepted from users.
Server or client templates combine data and markup.
const name = userInput;
message.innerHTML = `Hello ${name}`;If userInput is not trusted and safely handled, inserting it with innerHTML can turn data into markup or script. Text rendering or a trusted sanitizer is safer.
Untrusted content becomes executable in a trusted browser context.
A browser is tricked into sending an unwanted authenticated request.
Untrusted input changes the meaning of a database query.
| ENGLISH TERM | 中文 | SIMPLE ENGLISH | 中文小白理解 |
|---|---|---|---|
| XSS | 跨站脚本攻击 | An attack that makes untrusted content run as script in a web page. | 让不可信内容在网页中被当作脚本执行的攻击。 |
| Input | 输入 | Data supplied by a user or another system. | 用户或其他系统提供给应用的数据。 |
| Escaping | 转义 | Encoding special characters so they remain text. | 把特殊字符编码成普通文字，避免被当成代码。 |
| Sanitization | 清理 | Removing or safely transforming dangerous content. | 删除或安全处理可能有害的内容。 |
XSS occurs when untrusted data is allowed to become executable content in a trusted page.
Use context-aware output encoding, safe DOM APIs, carefully configured sanitization, and a strong Content Security Policy.