30 Days of JavaScript: Web Security and JavaScript, Day 29
One unescaped string is all it takes. A comment box, a search field, a URL parameter, someone drops a <script> tag
Content Security Policy CSP
One unescaped string is all it takes. A comment box, a search field, a URL parameter, someone drops a <script> tag