What is cross-site scripting (XSS) and how can it be prevented?

• A. Attacker uses scripts to access server-side resources.
• B. Attacker steals cookies via direct server access; prevention: disable cookies.
• C. Attacker injects scripts into trusted websites; prevention: input validation, output encoding, and content security policy (CSP).
• D. Attacker uses malware to take control of server; prevention: antivirus software only.

Answer: (C)

Cross-site scripting is a vulnerability where an attacker can inject malicious scripts into webpages that other users view. If a site displays untrusted input without handling it properly, the browser may execute that code in the context of the trusted site, potentially stealing session data, performing actions on the user’s behalf, or defacing content. The strongest defense combines several layers: validating or sanitizing inputs to remove dangerous content, encoding or escaping data before it’s rendered so it’s treated as text rather than executable code, and implementing a content security policy that restricts where scripts can be loaded from and disables inline scripts. Using security-friendly templating that auto-escapes content and marking cookies as HttpOnly further protects against script-based exploits. The other options describe different kinds of attacks or defenses that don’t address how XSS actually works.