When a web application takes in untrusted input and does not check it first, XSS vulnerabilities can occur. For example, if a web server puts the input in the page's HTML before sending it to the user's browser, then the code can be controlled by the person who submitted the malicious input.