Cross-site scripting (XSS)

- A cross-site scripting attack occurs … when an attacker injects code, … primarily HTLM and JavaScript into your webpages, … so that other users browsers will execute it. … It gets it's name because an attacker sends scripts … across your website to someone else's browser. … Cross-site scripting becomes possible … when webpages output user supplied data … in the HTML response without sanitizing the data first. … Cross-site scripting, often abbreviated as XSS, … is ranked as one of the top 10 security threats … and is the most common web application security flaw. … There are three types of cross-site scripting; … reflected, stored, and DOM-based. … Reflected attacks are the most common type. … Let's look closer at them … because they will help us to understand … all three types. … In a reflected XSS attack, an attacker puts JavaScript code … to be run in a URL string or in the form data … sent with the request. … When the page loads, the script runs immediately, … in the victim's browser. …