Cross-site scripting (XSS)

Meaning

Cross-site scripting (XSS) is an attack in which unescaped user-supplied text lets a script run in other visitors' browsers. The script could steal session information or change what the page shows. The defence is to escape output for the place where it appears: for HTML text, PHP's htmlspecialchars function converts the characters &, quotes, less-than and greater-than into entities, and since PHP 8.1 it converts both kinds of quote by default. Attributes, script blocks and web addresses each need their own treatment. See also: CSRF, SQL injection, and the guide PHP Security Basics: Validation, Prepared Statements and More.