XSS

What is XSS (Cross-Site Scripting) — code running in someone else's browser

XSS makes an attacker-supplied string run 'as script' in another user's browser — straight to session theft and impersonation. The real defense is escaping on output. Don't disable your framework's auto-escaping.