What it is

XSS occurs when untrusted input is reflected into a page without correct output encoding, so the browser executes attacker-controlled script. It comes in three forms: reflected (echoed from the request), stored (persisted and served to other users), and DOM-based (introduced entirely client-side by unsafe JavaScript sinks).

How to test for it

Inject a unique marker into every parameter, header, and path segment, then look for it rendered unencoded in HTML, attributes, JavaScript, or URL contexts. Escalate markers to context-appropriate payloads, and use polyglots and encoding tricks to slip past filters and WAFs.

How to prevent it

Encode output for the exact context (HTML, attribute, JS, URL), prefer framework auto-escaping, and add a strict Content-Security-Policy as defense in depth. Treat innerHTML and similar DOM sinks as dangerous and sanitize with a vetted library.