Question 1

What is XSS?

Accepted Answer

XSS (Cross-Site Scripting) is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.

Question 2

How do I prevent XSS?

Accepted Answer

Always escape user input before rendering in HTML. Use textContent instead of innerHTML, implement Content Security Policy headers, and use a sanitization library.

Question 3

What does HTML escaping do?

Accepted Answer

HTML escaping converts special characters like <, >, &, ' and " to their HTML entity equivalents (<, >, &, ', ") so they are displayed as text instead of being interpreted as HTML.