Question

What happens when an application takes user inputted data and sends it to a web browser, without proper validation?

Answer 1

XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. ... Without an access control check or other protection, attackers can manipulate these references to access unauthorized data

Answer 2

When an application takes the user input data and sends it to web browser, without proper validation cross site scripting takes place.

• A cross site scripting occurs whenever an application takes untrusted data and sends it without proper validation or escape to a web browser.
• The alteration allows the session ID of the victim to be sent to the domain of the attacker, thereby allowing the attacker to hijack the current session of the user.
• Cross-Site Scripting (XSS) attacks injects malicious scripts into trustworthy websites. XSS attacks occur when an attacker sends malicious code to a different end user using a web application, generally in the form of a browser-side script.