A comment containing <script> is saved and later shown to other users, running in their browsers. This is…
Options
- Reflected XSS
- Stored XSS (Correct option)
- CSRF
- SSRF
Answer
Stored XSS
Why
XSS (Cross-Site Scripting) means an attacker gets their JavaScript to run on your site, in other users' browsers. That script can steal data or act as the user.
Stored XSS: the malicious script is saved in your database (a comment, a profile name) and served to everyone who views it. Reflected XSS: it comes from a URL parameter and is echoed back once.
Defense: escape output (templates like Jinja and React do it by default), sanitize any HTML you allow, and add a Content-Security-Policy.
Remember
Stored XSS = malicious script saved and shown to others. Escape output.