Define cross-site scripting (XSS) and a common mitigation.

• A. Attacker injects malicious scripts into web pages.
• B. Attacker manipulates server configuration.
• C. Attacker injects malicious scripts into web pages; mitigate with input/output encoding and Content Security Policy (CSP).
• D. Attacker uses phishing to steal credentials.

Answer: (C)

XSS happens when an attacker injects malicious scripts into web pages that other users view, causing those scripts to execute in the victim’s browser. Because browsers run scripts found in a page, any untrusted input that’s embedded can become executable code. A common and effective mitigation focuses on output encoding: whenever you display user-supplied data, escape or encode it so the browser treats it as text rather than code. The encoding must be context-aware—HTML content, attribute values, URL parameters, and JavaScript blocks each require appropriate escaping. In addition, implementing a Content Security Policy helps prevent the execution of unauthorized scripts by whitelisting trusted sources and disallowing inline scripts unless a nonce or hash is used. Together, proper output encoding and a strict CSP significantly reduce the risk of XSS. Relying on server configuration changes or phishing protection does not directly prevent XSS, which is about how the page renders untrusted input.