A city services portal echoes webhook and form text into HTML pages. Reviewers flag reflected cross-site scripting risk. Which mitigation correctly addresses XSS?
Select an answer to reveal the explanation.
Short Explanation
Untrusted text in a page is like raw ingredients dumped straight into a finished plate—encode (or auto-escape) before it hits HTML or JavaScript. A firewall alone is not the XSS fix.
Full Explanation
XSS mitigation for OWASP-style threats centers on neutralizing untrusted output: context-appropriate encoding or framework auto-escape when writing user or webhook strings into HTML or JS. Session existence, firewall filtering, and moving the string into SQL do not address reflected or stored XSS in the page.