XSS (Cross-Site Scripting) is the injection of malicious JavaScript into a page viewed by other users. The script runs in the victim's browser with the current site's privileges: it can steal cookies, capture keystrokes, and make requests on behalf of the user.
Types
Reflected — script in the URL, reflected in a single response. Requires tricking the victim into clicking a link
Stored — script saved in the DB (comment, profile name) and shown to all visitors. Most dangerous
DOM-based — DOM manipulation via JavaScript without server involvement
Defence
Output escaping — convert special HTML characters to entities: < → <. In PHP — htmlspecialchars(); in template engines — automatic escaping via double-brace syntax
Content Security Policy — an HTTP header that blocks inline scripts and scripts from untrusted domains
Never render raw user-supplied HTML without sanitisation through a dedicated library (HTML Purifier, etc.)