XSS (cross-site scripting)

XSS involves placing code on a page (usually JavaScript) that runs in visitors' browsers. It can be used to steal a logged-in user's session, replace content or redirect, all on the victim's side, not the server.

The protection is correct "escaping" of content (so data is displayed, not executed) and the Content-Security-Policy header, which limits which scripts the browser is allowed to run.