Inside the Mind of a Hacker: Attacking Web Pages With Cross-Site Scripting

Cross-site scripting (XSS) is the No. 1 issue that plagues web application developers. XSS occurs when a webpage renders user input as HTML or JavaScript code. The most common method is HTML encoding, while URL encoding can help neutralize the injection of markup in links and redirects. Fixing XSS sometimes feels like playing whack-a-mole, but there is no silver bullet to prevent XSS. Use the innerHTML attribute, for example, for the user input to be rendered with JavaScript events.”]

Source: https://securityintelligence.com/inside-the-mind-of-a-hacker-attacking-web-pages-with-cross-site-scripting/