Software Engineering › Key terms › Y12 Secure Software Architecture › Cross-site scripting (XSS)
Cross-site scripting (XSS)
Term Key terms bank Y12 Secure Software Architecture
Also listed as: XSS
Definition
An attack that injects malicious script into a web page that other users then run in their browser. Prevent it by sanitising and escaping output.
Example: Escape user comments so scripts cannot run.
Found in: syllabus, course specifications, sample exam and familiarisation guidelines, school notes.
Cross-site scripting: malicious script injected into a page other users view.
Where it is used in the test
Syllabus area: Y12 Secure Software Architecture.
Question types it can appear in
- Multiple choice: Familiarisation Q11a
- Short answer: Explain how XSS works and how to prevent it (Q11b)
- Fill in the blanks: Choose this term to complete a statement or table.
Where it has appeared in the paper
Secure Software Architecture (Part C). Part letters follow each paper’s own layout.
Related past questions
- Familiarisation Q11a (1 mark): Cross-site scripting Secure Software Architecture (Part C) · 1 mark
- Familiarisation Q11b (2 marks): Cross-site scripting Secure Software Architecture (Part C) · 2 marks
These are the questions the flashcard set links to this term. Open each one and compare your answer with its marking criteria.
Study links
- Flashcard: Cross-site scripting (XSS) in Secure Software Architecture (Year 12) · study that set
- Memorise: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions
- Key terms bank entry: XSS
- Notes: User action controls: broken authentication, XSS, CSRF, forwarding, race conditions (Secure Software Architecture (Year 12))
- Notes: Design, develop and implement secure code to minimise vulnerabilities in user action… (Secure Software Architecture (Year 12))
- Notes: Defensive data input handling: validation, sanitisation, error handling (Secure Software Architecture (Year 12))
- Notes: Part 3. Where this has been examined (see ../../question_bank.md) (Secure Software Architecture (Year 12))
How to use it in an answer
A model sentence
“An attack that injects malicious script into a web page that other users then run in their browser.” Then apply it: Escape user comments so scripts cannot run.
In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.
Command words used with it
Technique for the question types
- Multiple choice: Read all four options, rule out wrong ones, pick one; no penalty for guessing so never leave blank.
- Short answer: One clear point per mark, use the stimulus and course terms, and answer the command word.
- Fill in the blanks: Choose the right word from a list; use exact syllabus terms.
What the marking guidelines and feedback say
Note (MG): special characters such as < > and ( ) would be encoded to their HTML equivalent (%3C %3E and %28 %29).
Worked answers from the marking guidelines
Familiarisation Q11a (1 mark): Cross-site scripting (1 mark): criteria and sample answer
Criteria
1: Identifies the correct answer.
Sample answer
Cross site scripting
Familiarisation Q11b (2 marks): Cross-site scripting (2 marks): criteria and sample answer
Criteria
2: Explains ONE way to minimise the vulnerability. 1: Some relevant information.
Sample answer
The website could check and change user input so that markup and script become plain text. This will still allow the page to display the information but will prevent it from executing script code.
Common mistakes
- Use the term exactly as the syllabus words it, then link it to the scenario in the question; the 2025 feedback repeatedly rewards using the stimulus.
- Answer the command word: outline gives main points only, explain gives a reason or cause, discuss gives both sides.
Related terms
Same group in the syllabus: Broken authentication and session management · Cross-site request forgery (CSRF) · Invalid forwarding and redirecting · Race condition · File attacks · Side channel attack