Can anybody explain XSS to an idiot?
First I ask is there an aboslute definition? I've done some Googleing and it seems like everyone says something different.
On SO one person says
An XSS vulnerability exists whenever a string from outside your application can be interpreted as code.
This sounds similar to a SQL injection but it attacks the web server, not the user?
Again it sounds like someone would mess with the URL to put malicious code into GET passed variables but wouldn't this be like attacking one's self?