XSS Prevention

XSS executes attacker-controlled scripts in a victim's browser — stealing tokens, hijacking sessions, or silently making authenticated requests.

Three types:

• Reflected — payload in URL, echoed in response (?q=<script>)
• Stored — payload saved to DB, rendered to all viewers
• DOM-based — payload never hits the server; JS reads URL/fragment and writes to DOM

Sink Inventory: Where XSS Happens

Every place user data reaches the DOM or HTTP response is a sink. Audit these first.

Dangerous sinks (browser)

// ❌ All of these execute scripts