#xss

XSS: running your code on their page

How cross-site scripting turns a comment box into a way to run JavaScript on someone else's session, demonstrated live, then fixed with proper escaping.