Learn the vocabulary of an attacker's script executing in a victim's browser as trusted code.
0 / 5 completed
1 / 5
At standup, a dev mentions an attacker's script being injected into a page and then executed in a victim's browser as if it were part of the trusted site's own code, because user-supplied input was rendered without proper escaping. What is this vulnerability called?
Cross-site scripting, or XSS, injects an attacker's script into a page so it executes in a victim's browser with the same trust and access as the site's own legitimate code, typically because user-supplied input was rendered into the page's HTML without being properly escaped first. SQL injection instead targets a database query's syntax, a different vulnerability class entirely, even though both stem from the same root cause of untrusted input being treated as executable syntax. This browser-side script execution is what lets XSS steal session cookies, hijack an account, or perform actions on the victim's behalf.
2 / 5
During a design review, the team requires every piece of user-supplied content to be HTML-escaped before it's inserted into a page's markup, converting characters like '<' into a safe encoded form. Which capability supports this?
HTML escaping ensures user-supplied text renders as plain visible text rather than being interpreted as executable HTML or script tags, since converting a character like '<' into its encoded form prevents the browser from treating it as the start of a new tag. Rendering user input directly with no escaping leaves the browser with no way to tell trusted site markup apart from untrusted user content, which is exactly the gap XSS exploits. This escaping-by-default approach is why most modern templating frameworks automatically escape output unless a developer explicitly opts out.
3 / 5
In a code review, a dev notices a component intentionally bypasses the framework's automatic escaping to render a piece of user-supplied text as raw HTML, so that any formatting tags the user typed will actually render. What does this represent?
This is a deliberately reintroduced XSS risk, since bypassing automatic escaping to let a user's formatting tags render also lets an injected script tag, or an event-handler attribute, execute exactly the same way any other markup would. A parameterized query is an unrelated defense from the SQL injection domain, not the XSS domain. This is exactly why any raw-HTML rendering path needs its own dedicated sanitization step, allowlisting only genuinely safe tags and attributes, rather than trusting the user's input to only ever contain harmless formatting.
4 / 5
An incident report shows an attacker's comment on a public page contained a script tag that executed in every visitor's browser and silently exfiltrated their session cookie, because the comment text was rendered as raw HTML with no escaping or sanitization applied. What practice would prevent this?
Escaping user-supplied text by default, or running any content that must support raw HTML through a dedicated sanitizer that strips dangerous tags and attributes, ensures an injected script tag in a comment can never actually execute in another visitor's browser. Continuing to render comment text as raw HTML with no escaping or sanitization at all is exactly what let the attacker's script run and exfiltrate cookies from every visitor in this incident. This escape-or-sanitize requirement is a baseline defense for any feature that renders user-generated content back to other users.
5 / 5
During a PR review, a teammate asks why the team runs user-generated HTML content through a dedicated sanitization library instead of just trusting a simple blocklist that strips out the literal string 'script' before rendering. What is the reasoning?
An attacker has many ways to get script to execute beyond a literal script tag, including an event-handler attribute like onerror on an image tag, or a javascript: URL in a link's href, none of which a blocklist searching only for the word 'script' would catch. A proper sanitizer instead allowlists a known-safe set of tags and attributes, rejecting or stripping anything not explicitly permitted, which is fundamentally more robust than trying to enumerate every dangerous pattern in advance. The tradeoff is the added dependency and configuration effort of a full sanitization library compared to a naive blocklist, but that tradeoff is well worth it given how easily a blocklist is bypassed.
What does the "Cross-Site Scripting (XSS) Vocabulary" vocabulary exercise cover?
This exercise tests real IT vocabulary related to cross-site scripting (xss) vocabulary through 5 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 5 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — this module shares real-world context with 11 other vocabulary modules. See "Related vocabulary" below to keep building a connected skill set.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.