Cross-Site Scripting (XSS) Prevention

XSS occurs when attacker-controlled data becomes executable markup or script in another user’s browser.

Prefer framework auto-escaping, context-aware output encoding, safe DOM APIs such as textContent, and strict CSP. Treat innerHTML, template interpolation in raw HTML, URL sinks, and script construction as explicit security boundaries.

<div>{escapeHtml(userProvidedText)}</div>
node.textContent = userProvidedText;