Dictionary · Hacking Techniques and Methodologies

A flaw in which a site sends another user's untrusted content back to a browser in a way the browser can treat as code. Output encoding and a content security policy reduce it.

The site meant to display text, but the browser may run it. Encode output for the context, avoid inserting raw HTML from users, and add a content security policy as a backstop.

Example: A comment feature stores input as text and encodes it on display, so a browser shows the characters instead of acting on them.