XSS

Short for Cross-Site Scripting. An attack technique that injects malicious scripts into web pages to steal users' information.

Oct 31, 2026 / About 1 min read

Security

XSS (Cross-Site Scripting) is an attack technique that exploits a vulnerability in a web application to inject malicious JavaScript code into a page and steal users' Cookies, session information, personal data, and so on. In the 2025 edition of the OWASP Top 10, XSS is included in A05 Injection.

According to OWASP's explanation of XSS (as of October 2026), XSS is generally divided into reflected and stored types, and separately there is the less well-known DOM-based XSS. They are, respectively, reflected XSS (a script contained in a URL parameter is displayed on the page as is), stored XSS (a script saved in a database is displayed to other users), and DOM-based XSS (occurs when client-side JavaScript manipulates the DOM).

OWASP's XSS prevention cheat sheet (as of October 2026) explains that no single technique solves XSS and that defensive techniques need to be combined correctly. The three considered most effective are framework protection features, output encoding (such as converting < to < and > to >), and HTML sanitization. It notes that Cookie attributes such as HttpOnly limit the damage of XSS but do not prevent it, and recommends using the CSP header as an additional layer rather than the main defense.

In a URL shortener, there is a risk of XSS when URLs entered by users are displayed on a page. In particular, if URLs with the javascript: scheme are allowed, arbitrary JavaScript is executed when the link is clicked. OWASP's cheat sheet also gives, as an example countermeasure, allowing only URLs whose protocol is http:// or https:// when untrusted URLs are used as link destinations.

Was this article helpful?

Related Terms

CSP

Content Security Policy - an HTTP header that controls which resources a browser is allowed to load for a given page.

CORS

Cross-Origin Resource Sharing - a browser security mechanism that controls which domains can access resources from another domain.

Input Validation

The process of verifying whether input data from users matches the expected format and range. One of the security measures.

Clickjacking

An attack that tricks users into clicking on hidden elements by overlaying transparent frames on top of legitimate web pages.

SQL Injection

An attack that inserts malicious SQL code into application queries through user input fields to manipulate the database.

Phishing

A cyberattack that uses deceptive links and websites to trick users into revealing sensitive information.

Short URL Security - Phishing Risks, Safe Sharing Practices, and Protection Guide

A comprehensive guide to short URL security. Understand phishing risks, malware distribution via shortened links, and best practices for safe sharing.

Short URL Phishing - How to Spot Scams and Protect Yourself from Malicious Links

Learn to identify phishing attacks that use short URLs. Covers 5 common scam patterns, URL preview tools, and practical defense strategies.

Click Fraud Prevention: Protect Short URLs from Bots

Understand click fraud tactics and learn how to defend your short URLs. Covers bot detection, rate limiting, CAPTCHA strategies, and anomaly detection.

FAQ

What types of XSS attacks are there?

They are generally divided into reflected and stored types, and separately there is the DOM-based type. In the stored type, the attack code is saved on the server and also affects other users.

What are the basic countermeasures to prevent XSS?

OWASP's cheat sheet recommends framework protection features, output encoding, and HTML sanitization in every case, and treats CSP and Cookie attributes such as HttpOnly as measures added on top of them.

Put the terms to work

Shorten a URL for Free