Content executed in the browser.
WHAT IT IS
Submitted content rendered into a page and executed by the browser.
WHAT IT ALLOWS
Stealing sessions Acting as the visitor Altering what people see Capturing what they type
WHAT CAUSES IT
Output not escaped for its context.
WHAT CONTEXTS REQUIRE DIFFERENT TREATMENT
Content in markup Content in an attribute Content in an address Content inside a script
WHY THAT MATTERS
Escaping correct for one context is insufficient for another.
WHAT FRAMEWORKS DO
Escape by default in templates.
WHAT TO CHECK
Where that has been deliberately disabled, and why.
WHAT ELSE TO CHECK
Content inserted by scripts, which bypasses template escaping.
WHAT TO USE FOR USER-SUBMITTED FORMATTED CONTENT
An established sanitising library, permitting only safe elements.
WHAT TO NEVER DO
Write your own filter.
WHAT TO NEVER TRUST
Data from your own database, which was once input.
WHAT ADDS DEFENCE
A content security policy, restricting what may execute.
