Cross-site scripting is prevented by controlling untrusted input and how it’s rendered in a browser. The most effective and commonly used defense is to validate inputs to reject dangerous content and to encode data on output so anything potentially harmful is treated as text rather than executable code. Input validation reduces the amount of unsafe data that can enter the system, while output encoding neutralizes data when it’s displayed by transforming characters like <, >, &, and quotes into safe HTML entities. The right encoding depends on the context—HTML content needs HTML entity encoding, URLs need URL encoding, and data injected into scripts or attributes requires context-appropriate escaping. Together with broader safeguards like content security policies and proper data sanitization, this approach provides solid protection against XSS. Relying on client-side scripting alone isn’t enough because security controls must be enforced on the server and validated by the browser; storing passwords in plaintext has nothing to do with preventing XSS and creates other serious risks; disabling JavaScript on clients is impractical and would break legitimate functionality while not reliably stopping XSS.