How to find and fix XSS vulnerabilities?

Cross-Site Scripting (also known as XSS) is one of the most common application-layer web attacks. XSS vulnerabilities target scripts embedded in a page that is executed on the client-side (in the user’s web browser) rather than on the server-side. XSS in itself is a threat that is brought about by the internet security weaknesses of client-side scripting languages, such as HTML and JavaScript.

Identifying Cross-Site Scripting Vulnerabilities:

• Input coming into web applications is not validated
• Output to the browser is not HTML encoded

Fixing cross-site scripting errors in applications involves three steps:

• Applications must validate data input to the web application from user browsers.
• All output from the web application to user browsers must be encoded.
• Users must have the option to disable client-side scripts.