Vulnerabilities/Cross-Site Scripting
Untrusted input renders into a page without proper output encoding, letting an attacker's script run in another user's browser. Pick a language below for the full explanation, vulnerable/fixed code, and language-specific gotchas.