Protecting users from XSS, clickjacking and unsafe embeds with safe HTML practices.
The most important HTML-related threat is cross-site scripting (XSS), where an attacker injects malicious scripts into a page that then run in other users' browsers. The core defense is to treat all user input as untrusted: escape it on output, avoid inserting raw HTML with innerHTML, and sanitize any HTML you must allow. A Content Security Policy (CSP), delivered as a header or meta tag, adds a strong second layer by restricting which sources scripts, styles and frames may load from.
Other markup-level protections include using rel="noopener noreferrer" on external links with target="_blank", the sandbox attribute on iframes, Subresource Integrity (integrity attribute) to verify scripts and styles loaded from a CDN, and preventing clickjacking with frame-ancestors or X-Frame-Options. Forms need CSRF protection and should always be served over HTTPS, and autocomplete settings matter for sensitive fields. Strong interview answers explain the attack, then the specific defense that blocks it.
What you'll walk away knowing