cross-site scripting
Cross-site scripting lets untrusted content execute in another user’s browser.
Use this when User-provided text or rich content is rendered on a page.
without the term
“Users can write comments with some formatting. I'm worried someone could put a script in a comment that runs for everyone else. Can you make comment display safe?”
with the term · How do you ask a model for cross-site scripting?
Review this rendering path for XSS. Keep text escaped, sanitize allowed rich content, and test malicious markup and URL inputs.
What is cross-site scripting?
Untrusted text is inserted into a page as HTML, an attribute, a URL, or script, and the browser runs it. Each of those places needs its own encoding or sanitization.
Why does cross-site scripting matter when vibe coding?
Generated string templates can cross from displaying text into executing markup.
How do you do cross-site scripting?
Keep text escaped; sanitize deliberately allowed markup and validate URL contexts.
What goes wrong with cross-site scripting?
Applying one hand-written escaping rule to HTML, attributes, URLs, and JavaScript.