Glossary / Cross-site scripting
Cross-site scripting: what it means
An attack where typed text is run as code. Showing text with textContent, never innerHTML, prevents it.
How it shows up when you build
- Keep track of things: An attack where typed text is run as code. Showing text with textContent, never innerHTML, prevents it.
A tip
- The rule: change state, then call render(). Never edit the screen and the data separately.
Practise it
Build it with an AI tool and check the result in these exercises:
- 2. Keep track of things (State and render)