Definicja cross-site scripting

Describes the manipulation of user entries that are transferred to a Web application when an attacker embeds harmful program code into a correct environment, so that this code is executed on client-side.

XSS attacks are mostly used for spying purposes, to manipulate user data, or to execute foreign program code.

Example:

Web applications are often programmed in script languages (typically JavaScript) to allow dynamic content where the user entries are coded in the GET parameters of the URL. If these parameters are then processed in the program without being checked, it is possible for harmful code to reach the generated Web site where it is then executed by the browser. Since the JavaScript code that is executed locally is able to access the cookies managed by the browser, it is possible for content to be read and transferred to another Web site, for example.

You can protect against cross-site scripting by checking and filtering all user entries.