Which practice helps prevent XSS by neutralizing script output?

• A. Content Security Policy
• B. Input validation
• C. Parameterized queries
• D. Output encoding

Answer: (D)

Neutralizing script output through encoding is essential because it makes dynamic data safe to insert into a web page by treating it as text rather than code. When content is encoded for the HTML context, characters that could start a tag or script—such as <, >, &, ", and '—are converted to safe representations like <, >, &, ", and '. This means the browser displays the characters as text instead of executing them, so any injected script cannot run and XSS is blocked.

Encoding must be applied to content before it’s inserted into the page, and you have to consider the context—HTML body, attribute values, or inline JavaScript contexts—because the safe representations differ by context. Without proper encoding, user-supplied input can be interpreted as markup or code, opening the door to XSS.

Other options address different layers of security. A policy that limits where scripts can be loaded helps reduce exposure but doesn’t fix how output is treated; validating input attempts to reject bad data but can be bypassed and isn’t sufficient on its own for all contexts; parameterized queries protect against SQL injection, not cross-site scripting. So the technique that most directly and reliably prevents XSS by neutralizing potentially dangerous output is output encoding.