##### ###### ##### ### # # ### # # ###### ## ## ## ## ## ## ## # # # # # ## ##### #### ##### # # # # # # # #### ## # ## ## ## ## # # # # # ## ## # ###### ## ### # ### # ######
##### ###### ##### ### # # ### # # ###### ## ## ## ## ## ## ## # # # # # ## ##### #### ##### # # # # # # # #### ## # ## ## ## ## # # # # # ## ## # ###### ## ### # ### # ######
When AI renders user input
XSS happens when user input is rendered as HTML without escaping. AI-generated frontend code often does this:
element.innerHTML = userComment
If userComment contains , it runs. Use textContent instead:
element.textContent = userComment
Frameworks like React escape by default. But innerHTML and dangerouslySetInnerHTML bypass that protection.
