XSS injects malicious scripts into your application.
Types:
- Stored: Malicious script saved in database, served to all users
- Reflected: Script in URL parameters rendered in response
- DOM-based: Client-side code unsafely manipulates DOM
Prevention:
- Escape user input before rendering
- Use framework's built-in escaping (React escapes by default)
- Avoid innerHTML and dangerouslySetInnerHTML
- Sanitize HTML if you must render it
Example attack: User enters '' in comment. Without escaping, it executes.