Why should you care?

One XSS bug can steal cookies or session tokens.

See it live — copy this example

Paste into an HTML file or the browser console (F12). Use Run below when the live editor is available.

const userInput = '<img src=x onerror="alert(1)">';
const safe = document.createElement("p");
safe.textContent = userInput; // shows text, does not run script
document.body.appendChild(safe);

Run Example »

Edit the code below and click Run to see the result in Toolliyo’s live editor.

What happened?

• textContent escapes HTML.
• innerHTML with user data is dangerous unless sanitized.

Practice next

1. Render malicious string with textContent safely.
2. Contrast dangerous innerHTML with same input.
3. Enable CSP header on server.
4. Use DOMPurify sketch comment when HTML formatting is required.
5. Set Content-Security-Policy meta for local demo.

Remember

Use textContent for user text Sanitize if HTML needed CSP as backup

ScriptVerse comment wall

User comments display via textContent so injected script tags render as harmless text.

Outcome: XSS defenses protect ScriptVerse users from session theft via malicious posts.