> For the complete documentation index, see [llms.txt](https://dev7days.gitbook.io/dev7days/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev7days.gitbook.io/dev7days/backend-security/cross-site-script-xss.md).

# Cross site script (XSS)

This is the way that hacker can pass the script like `Javascript` into our system or database.

#### Example

<img src="https://2166680554-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FP9VzT74ziIucCaJgfreE%2Fuploads%2F725cIRJbDPgkUZQIDwNw%2Ffile.excalidraw.svg?alt=media&amp;token=149320f8-c93a-4189-8f86-598665df35ce" alt="" class="gitbook-drawing">

1. We have a database that store comments in plain text without validation input
2. Hacker send the script as a text for input then we store it in DB
3. After client open the website to view the comment then the script will be run.

#### How to Protect

1. Input validation to protect script
2. Encode data before  render html -> Modern framework already handle it such as React it will escapes special characters by default.
3. Add header `Content Security Policy(CSP)`-> to determine with kind of JS script can run&#x20;