EXERCISE 1 — The root cause of XSS in "data vs code" terms
==========================================================

THE ROOT CAUSE (data vs code):
  A web page is HTML -- a mix of MARKUP (code: tags, scripts, attributes the
  browser ACTS on) and TEXT (data: content meant only to be DISPLAYED). XSS
  occurs when untrusted input that should be treated as DATA (just shown to
  the user) is instead inserted into the page in a position where the browser
  treats it as CODE (parses and executes it).
  - The browser parses whatever bytes are in the HTML. It has no idea which
    characters came from the trusted developer and which from an attacker --
    it just follows HTML rules. So if attacker text contains markup like
    <script>, and it lands unescaped in the HTML, the browser dutifully
    treats it as a real script element and runs it.
  - In one line: XSS = a confusion between DATA and CODE, caused by failing
    to keep untrusted input as data (failing to encode it on output).

WHY ?name=<script>alert(1)</script> EXECUTES:
  - The developer wrote a template like:  <h1>Hello, NAME</h1>  and dropped
    the raw `name` value into NAME with no encoding.
  - Intended: name="Philip" -> <h1>Hello, Philip</h1>. Here "Philip" sits in
    a TEXT position, displayed as data. Fine.
  - Attack: name="<script>alert(1)</script>". After substitution the HTML is:
        <h1>Hello, <script>alert(1)</script></h1>
  - The browser, parsing this HTML, sees a literal <script> START TAG. By
    HTML rules that opens a real script element, so it executes alert(1).
    The characters < > / were taken as MARKUP, not as the literal text the
    developer assumed.

THE FIX (preview of Chapter 6):
  - Encode the input ON OUTPUT for its context. In an HTML text context,
    convert < > & " ' into HTML entities:
        <  ->  &lt;     >  ->  &gt;     &  ->  &amp;
  - Then the attack renders as:
        <h1>Hello, &lt;script&gt;alert(1)&lt;/script&gt;</h1>
    The browser now shows the literal text "<script>alert(1)</script>" on the
    page -- as DATA -- and runs nothing. The input stayed data instead of
    becoming code. That single discipline (encode on output, per context) is
    the foundation of XSS defence.