Figure 1. XSS vulnerabilities in a hypothetical Web application
(a) Vulnerable code of a hypothetical photo-sharing application.
(b) Another slice of the photo-sharing application.
(c) Using an HTML markup template.
Figure 2. Preventing XSS through use of inherently safe APIs.
(a) Replacing ad-hoc concatenation of HTML markup with a strict template.
(b) A safe wrapper API.
(c) Using a type to represent safe HTML markup.