Cross-site scripting also known as XSS attack allows the attacker to pretend as a victimised user to carry out the actions that the user can perform, in turn, stealing any of the user’s data. If the attacker can masquerade as a privileged victimised user, one can gain full control over all the application’s data and functionality. Here, the attacker injects malicious client-side code into web services to steal information, run destructive code, take control of a user’s session, and perform a phishing scam.
Here are the ways to prevent an XSS attack:
Cross-check the user’s input
Sanitize HTML
Employ anti-XSS tools
Use encoding
Check for regular updates of the software