Cross-Site Scripting

In Cross-site Scr/ipting (XSS) a visitor to your site adds JavaScript code which gets loaded by other visitors: forum posts, usernames, etc.

<html>
  <head><title>Hello</title></head>
  <body>
<script>
var name = decodeURIComponent(window.location.search.substring(6)) || "";
document.write("Hello " + name);
</script>
</body>

./xss.html?name=Adama
./xss.html?name=%3Cscript%3Ealert('Iam37173')%3C/script%3E
I could also load a whole script file or read cookies from that site.
Sanitize! or else.