Security Practice · Core OWASP

Cross-site scripting investigation

Trace untrusted profile content into an HTML context, distinguish execution from reflection, and verify contextual encoding plus CSP defense in depth.