XSS — executing foreign JavaScript on your site. Cookie theft, session hijack.
Types
Reflected, Stored, DOM-based.
Protection: escaping
htmlspecialchars($input, ENT_QUOTES, 'UTF-8').
CSP
Content-Security-Policy header — blocks external scripts.
HttpOnly cookies
JS can't read cookies.
Framework auto-escape
React, Vue, Angular.