XSS defence is about keeping attacker-controlled values in the right parser context. These questions focus on sink choice, URL policy, rich-text sanitisation, CSP, Trusted Types, and the client-side paths where DOM-based bugs hide.
0 / 6
A forum comment field only needs plain text. Which change removes the XSS risk at the earliest point?
Press 1 to 4 to pick an answer