Learn in the textbookSecure Development (By-Design Principles and Vulnerability Countermeasures)
DefinitionCross-site scripting (XSS) countermeasures (クロスサイトスクリプティング対策) keep text entered by users from running as a script (a small program that runs in the browser) in the browser of whoever views the web page.
ExplanationCross-site scripting (XSS) is an attack that uses a website which displays input as it is to run a script planted by the attacker in the viewer's browser, often to steal login details. The main countermeasure is escaping: before input text is shown on the page, symbols with special meaning in HTML, such as "<" and ">", are replaced with forms that display as plain characters. Processing of this kind, which turns dangerous strings in input into a harmless form, is collectively called sanitizing.
AnalogyIt is like a notice-board keeper who never pins up a received notice as it is, but first seals it in a clear sleeve so that any trick hidden inside cannot work.
Memory hook"Cross-site" means crossing between sites: the script is passed from a page the attacker prepared to a different, vulnerable website and runs there, which is where the name comes from.