XSS attacks occur any time a possible malicious actor is allowed to post material to a trusted website that isn't first sanitized or scrubbed to make sure it is safe. An example of this attack is as follows:

Suppose we are using JSP to read in a student ID - sid - from a HTTP request and display it to the page. The code for this is as follows:

<% String sid = request.getParameter("sid"); %>
...
Student ID: <%= sid %>

In this case, if no sanitization or scrubbing occured of the inputted value "sid" between when we retrieve it from the HTTP request object and the time it is displayed to the user, then a possible malicious actor could inject their own JavaScript. This JavaScript would come in via the "sid" parameter and be executed on the client's browser when it the "sid" parameter is displayed to the screen.
spam fails_task lang_mismatch pii not_appropriate hate_speech sexual_content quality toxicity humor helpfulness creativity violence