What does “XSS attacks” mean?

// Sanitize user input to prevent XSS attacks
$folderName = htmlspecialchars($_GET['folderName']);

XSS stands for Cross-Site Scripting, which is a type of web application vulnerability. XSS attacks occur when an attacker injects malicious scripts into web pages viewed by other users. These scripts are typically written in JavaScript, but other scripting languages can also be used.

There are three main types of XSS attacks:

1. Stored XSS (Persistent XSS): The malicious script is permanently stored on the target website, often in a database, and is executed whenever a user views the affected page. This type of XSS is especially dangerous, as it can affect multiple users and requires less interaction from the attacker.
2. Reflected XSS (Non-persistent XSS): The malicious script is not stored on the target website but instead delivered through a link, often via email or instant messaging. When a user clicks on the link, the script is executed in the user’s browser. This type of XSS requires the victim to take an action, such as clicking a link, for the attack to be successful.
3. DOM-based XSS: This type of attack occurs when the attacker manipulates the Document Object Model (DOM) of a web page in the user’s browser, causing the malicious script to be executed. This can happen, for example, when a website uses user input to update the DOM without proper validation or sanitization.

XSS attacks can lead to a variety of security issues, including data theft, session hijacking, and unauthorized actions performed on the user’s behalf. To mitigate XSS vulnerabilities, web developers should employ secure coding practices, such as input validation, output encoding, and using security-focused web frameworks.