Reference
What is Cross-site scripting?
Cross-site scripting is an attack where someone gets their own JavaScript to execute in another user’s browser, in the context of your site. The usual route is submitting content that gets stored and later displayed to somebody else without being properly escaped for the context it appears in.
Also called: XSS · script injection
The three forms
- Stored
- Malicious input saved and served to other users. The most damaging.
- Reflected
- Input echoed straight back in a response, typically via a URL parameter.
- DOM-based
- Client-side code writing untrusted data into the page.
The defences, in order
- Escape output based on context — HTML, attribute, JavaScript and URL contexts each need different handling
- Validate input on the server, never only in the browser
- A Content Security Policy, which limits the damage even when an injection succeeds
- Avoid innerHTML with untrusted data; use textContent
Where it appears on small sites
Contact form submissions displayed in an admin panel, and search terms echoed back on a results page. Both feel harmless, and both are the classic vector.
Where this is covered in depth
A definition can only go so far. Technical SEO, in the order the problems actually block you covers this properly — 4 minutes, free, no email required.
Who wrote this
Anas Bin Masud builds e-commerce sites and does technical SEO for businesses in the UK, Canada and Pakistan. These definitions come from client work rather than from a content brief — where an entry describes a mistake, it is usually one found on a real site. More about how I work.