Simple definition
Cross-site scripting injects executable content into pages viewed by other users, potentially compromising browser sessions.
Purpose and use
XSS, Cross-Site Scripting, occurs when untrusted data becomes active content executed in a site's context.
How does it work?
The flaw can occur in server rendering or DOM manipulation. Required encoding depends on the relevant HTML, attribute, URL or JavaScript context.
Example and verification
For prevention, review dynamic outputs, framework escaping and sanitization where rich HTML content is intentionally permitted.
Points to watch
CSP or input filtering alone does not replace correct output handling. Merely escaping quotation marks does not protect every context.
In short
Protection keeps data as data and reserves code execution for content actually controlled by the application.