When a user injects malicious script into an otherwise trusted website. The malicious script will then run on the victim’s web browser, often in an attempt to steal user information such as credentials, session cookies and other sensitive data. Anywhere that allows user input can be vulnerable to an XSS attack. To avoid these attacks a web developer must ensure that user input is validated and encoded before it outputs this as a request. Despite being discovered in the 1990s cross-site scripting has consistently remained as one of OWASPs top 10 web application security risks.

When a user injects malicious script into an otherwise trusted website. The malicious script will then run on the victim’s web browser, often in an attempt to steal user information such as credentials, session cookies and other sensitive data. Anywhere that allows user input can be vulnerable to an XSS attack. To avoid these attacks a web developer must ensure that user input is validated and encoded before it outputs this as a request. Despite being discovered in the 1990s cross-site scripting has consistently remained as one of OWASPs top 10 web application security risks.