What describes cross-site scripting and how to prevent it?

• A. XSS occurs when attackers inject scripts into trusted web contexts; prevention includes input validation, context-aware encoding, and CSP
• B. XSS is a hardware vulnerability
• C. XSS cannot be prevented
• D. XSS is best prevented by disabling all JavaScript

Answer: (A)

Cross-site scripting is a web vulnerability where untrusted input is handled in a way that allows a malicious script to run in the user’s browser within the trusted site’s context. The strongest defense is layered: validate and sanitize input to reduce dangerous content, encode output in a context-aware way (HTML, attribute, JavaScript, URL, etc.) so data is treated as data rather than code, and apply a Content Security Policy that restricts which scripts can run and where they can come from. Together, these defenses reduce the chance an injected script will be executed and limit what it can do if it does run.

The other options don’t fit because XSS is not a hardware vulnerability, it can be prevented with proper controls, and simply disabling all JavaScript is impractical and insufficient to address all XSS vectors.