Understand

Websites face predictable risks that good habits prevent.

Two well-known risks are injection (untrusted input treated as code) and cross-site scripting (malicious scripts running in a page). The defence is to validate and escape all user input and never trust data from the browser. This lesson is about protection, not exploitation.

Analogy: Trusting raw user input is like letting anyone into the kitchen — you must check what they bring in.

See It in Action

Escaping user input keeps it as text, not code:

// safe: treat input as text
element.textContent = userInput;
// risky: input could inject markup
// element.innerHTML = userInput;

Try It Yourself

1. Find where a small app displays user input.
2. Make it use textContent safely.
3. Note why trusting input is dangerous.

Challenge

Explain how escaping user input helps prevent cross-site scripting.

Success condition: You can explain why user input must be validated and escaped.