When a message becomes code
Imagine a website noticeboard that displays visitor messages. An attacker posts code as a message. If the site treats it as instructions instead of text, the code runs in other visitors’ browsers.
The code might read page data, act as a signed-in visitor, or show a fake login form. It can be saved in a message, carried in a link, or introduced by unsafe page updates.
Keep visitor content as text
Sites should display messages as text, not runnable code. If they allow formatting, they must remove unsafe parts. Cookie settings can limit the harm, and Content Security Policy adds another layer of protection. Neither replaces safe handling of content.