# Cross site script (XSS)

This is the way that hacker can pass the script like `Javascript` into our system or database.



#### Example



<img src="https://2166680554-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FP9VzT74ziIucCaJgfreE%2Fuploads%2F725cIRJbDPgkUZQIDwNw%2Ffile.excalidraw.svg?alt=media&#x26;token=149320f8-c93a-4189-8f86-598665df35ce" alt="" class="gitbook-drawing">



1. We have a database that store comments in plain text without validation input
2. Hacker send the script as a text for input then we store it in DB
3. After client open the website to view the comment then the script will be run.



#### How to Protect

1. Input validation to protect script
2. Encode data before  render html -> Modern framework already handle it such as React it will escapes special characters by default.
3. Add header `Content Security Policy(CSP)`-> to determine with kind of JS script can run&#x20;
