Can you explain what cross-site scripting (XSS) is?

Cross-site scripting (XSS) is a web application vulnerability where an attacker injects malicious script (usually JavaScript) into content that is then displayed to other users. This allows the attacker to execute scripts in the victim's browser, which can lead to session data theft, redirection to malicious sites, or other unwanted actions.

Example: if a website displays user input without proper filtering, an attacker can insert <script>alert('XSS')</script>, and this script will execute for other users.

To protect against XSS:

• Escape or filter user input before output.
• Use Content Security Policy (CSP).
• Use safe methods for working with templates and data.