Security guides

How do I prevent cross-site scripting (XSS)?

Treat everything from users as text. Let your framework escape output, avoid inserting raw HTML, and sanitize it when you truly need it. Then add a Content Security Policy as a second layer.

The fix

element.innerHTML = comment;

element.textContent = comment;

Check these places

1. Search for innerHTML, dangerouslySetInnerHTML, v-html and document.write.
2. If you must show user HTML, clean it with a maintained sanitizer such as DOMPurify.
3. Check links: only allow http: and https: addresses from users.
4. Set session cookies to HttpOnly, Secure and SameSite.
5. Add a Content Security Policy that blocks inline scripts where you can.

Does React prevent XSS?

It escapes ordinary values for you, which covers most cases. It doesn't protect dangerouslySetInnerHTML or links with unsafe addresses.