Cross-Site Scripting (XSS) is the most pervasive vulnerability
present in Web applications today. That being said, it is
possible to build Web apps that are impervious to XSS by arming
yourself with an understanding of the threat and a basic toolbox
of encoding functions. The attack occurs in a variety of
scenarios where data is taken in by your website and then
replayed to the user as an executable script. For example,
imagine navigating to the following URL: If the website were to
replay the query string parameter into its HTML markup verbatim,
malicious script would execute on the page. Given the same-
origin policy security model of the browser, this script could
perform actions or access data on behalf of the user behind the
keyboard. There are numerous other ways that an XSS
vulnerability might arise. For example, imagine your Web
application presents a page with a list of users. If one of the
users managed to set their visible name to a SCRIPT element, we
then have XSS, though this scenario does not inv