What is XSS? Encode output vs sanitize input.

Question

Accepted Answer

XSS prevention Cross-site scripting injects malicious JS viewed by other users. Defense: encode output (HTML escape), CSP headers, sanitize rich HTML, avoid innerHTML with user data. Stored XSS in comments Reflected XSS in search query Framework auto-escaping (React text nodes) helps—don't bypass carelessly.