Intermediate Topic 25 of 51 Security & Cryptography
Cross-Site Scripting
Attack injecting script into pages seen by others.
How it works
XSS injects scripts into pages viewed by others (stored, reflected, DOM-based) to steal sessions or act as the user. Defend by contextual output encoding, CSP and HttpOnly cookies.
Where it is used
Comment sections and search boxes.
Common pitfall
Using innerHTML with untrusted data.
Where it fits in the course
Cross-Site Scripting is topic 25 of 51 in Security & Cryptography, rated Intermediate. It follows SQL Injection. The next topic is CSRF.
Practice and explore
- Open the interactive lesson, with a mini quiz.
- Take the Security & Cryptography quiz.
How to study this topic
- Read the explanation above and restate the definition in your own words.
- Open the interactive lesson and answer its mini quiz.
- Read the common pitfall, then write a short example that avoids it.
- Check your understanding in the Security & Cryptography quiz, and revisit the topic if you miss a question.
Frequently asked questions
What is Cross-Site Scripting?
Attack injecting script into pages seen by others. It belongs to Security & Cryptography and is an intermediate-level topic.
Where do people use Cross-Site Scripting?
Comment sections and search boxes.
What is the most common mistake with Cross-Site Scripting?
Using innerHTML with untrusted data.
What should I learn before this topic?
Start with SQL Injection, the topic just before it in Security & Cryptography.
How can I practice it?
Answer the mini quiz in the interactive lesson, then take the Security & Cryptography quiz.
Is Cross-Site Scripting hard to learn?
It is an Intermediate topic. Be comfortable with the Beginner topics in this area first, then read the common pitfall carefully, since it is where most mistakes happen.
How long does it take to learn Cross-Site Scripting?
Most learners can read the explanation and finish the interactive lesson in under an hour. Fluency comes from applying the idea, so plan a few short practice sessions with the quiz.
Which topics are related to Cross-Site Scripting?
SQL Injection, CSRF, Message Authentication Codes are closely connected. The full list is in the related topics section of this page.
What should I study after Cross-Site Scripting?
Continue with CSRF, the next topic in Security & Cryptography.
Related topics
- SQL Injection (Security & Cryptography)
- CSRF (Security & Cryptography)
- Message Authentication Codes (Security & Cryptography)
- Buffer Overflow (Security & Cryptography)
- Cross-Platform Frameworks (Mobile, Embedded & IoT)
- Shell Scripting (DevOps & Tooling)
- Cross-Validation (AI & Machine Learning)