Cross-site scripting

Cross site scripting (sometimes abbreviated XSS) is a type of computer security exploit where information from one context, where is is not trusted, can be inserted into another context, where it is. From the trusted context, an attack can be launched.

A classic example of cross site scripting is to supply parameters to a CGI script on a web site which cause the web site to emit bogus data. For example, the use of HTML client-side scripting language fragments in a web page parameter may insert this information into the rendered page, resulting in targeted web browsers executing the code.

Alternatively, fragments of server-side scripting language may be executed by the web server itself.