Learn in the textbookAttacks on Web Applications
DefinitionCross-site scripting (クロスサイトスクリプティング, XSS) is an attack that exploits a flaw in how a website handles input, so that an attacker's script runs in the browser of anyone who opens the page.
ExplanationA script is a small program embedded in a web page and run by the browser. If a site writes text it receives, such as message-board posts, into its pages without sanitizing it (converting it into a form that cannot run as a script), a script hidden in that text runs on the viewer's screen. The script can then cause harm, for example by sending the attacker the cookie (a small piece of data a site has the browser store) that keeps the user logged in.
AnalogyIt is like slipping a gadget onto a shop's notice board that lifts the membership card from the pocket of whoever reads the notices. The gadget does its work not at the board but in the reader's hands.
Memory hookThe X in XSS is shorthand for "cross"; writing it this way keeps it from being confused with CSS, the style-sheet language.