Innomerc Choose your depth. Learn at your own pace.
Understand it
Cross-site scripting occurs when a page lets untrusted input become executable browser content in a trusted site’s context. A comment should be displayed as a comment, not become instructions that act through another visitor’s session.
The fictional comment board compares unsafe HTML insertion with a plain-text rendering path. The example never executes user-supplied code. Its purpose is to show where a browser changes from displaying data to interpreting instructions.
Under the hood
Reflected XSS returns input in a response; stored XSS persists it for later visitors; DOM-based XSS can arise when client code sends untrusted data into an unsafe sink. These categories overlap in real data flows.
Output encoding must match the destination context. HTML text, attributes, URLs and JavaScript have different rules. Prefer safe sinks such as textContent for plain text. If rich HTML is required, use a maintained sanitizer with an appropriate policy rather than a handwritten blacklist.
Practitioner perspective
Inventory sources and sinks across templates, client routing, Markdown rendering and third-party widgets. Framework escaping is helpful until an escape hatch accepts raw HTML. Test the rendered context, not only the stored representation.
CSP and Trusted Types can reduce exposure when correctly deployed, but are defense in depth. HttpOnly cookies limit script reading of that cookie, yet injected script may still perform actions as the user. Investigate both exfiltration and unauthorized state changes.
Watch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
Explore the system
Comment
A visitor submits untrusted text.
Read every step without animation
Unsafe HTML sink
- Comment. A visitor submits untrusted text.
- HTML insertion. The application inserts it as raw markup.
- Browser interpretation. The browser treats content as instructions in the site’s context.
The unsafe sink crosses the data/code boundary.
Safe text sink
- Comment. The same text reaches the renderer.
- Text insertion. The renderer uses a plain-text sink.
- Displayed text. The characters remain visible data rather than instructions.
Choose the rendering context deliberately.
Attack view
An unsafe rendering path interprets an untrusted comment as active content. The trusted origin gives that content access to capabilities it should never receive.
Defender view
- Use safe text rendering and context-appropriate output encoding.
- Sanitize permitted rich HTML with a maintained library.
- Add a restrictive CSP and avoid unnecessary inline execution.
Common mistakes
- Filtering one suspicious word is not a robust defense.
- HttpOnly does not stop all actions possible through XSS.
Check your understanding
Active recall: explain this idea in 30 seconds
Cross-site scripting occurs when a page lets untrusted input become executable browser content in a trusted site’s context. A comment should be displayed as a comment, not become instructions that act through another visitor’s session.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Read the editorial policy.