HowTo:Protect Your Users by Ensuring that Data Never Executes as Code

A Cross-Site Scripting (XSS) attack is one in which a script is entered into the data stream. Then, when the data is displayed, the script executes. This guide explains how an XSS attack works, and shows you how to guard against it.

Inserting a Script as Data

To start, let's see how such an attack works.