As I understand it, that which we call XSS is caused by an insufficient escaping of user input and primarily happens in web applications, as shown in this question. For example, the following piece of code is vulnerable:
<?php echo $_GET['q']; ?>
But the following fixes it:
<?php echo htmlspecialchars($_GET['q']); ?>
The user input can be stored in the database too, and the same thing happens if the input is not escaped when it is brought back for display. And in fact, this seems to be the method of attack that is the most beneficial for the attacker (affects the most users) and thus the most used.
Instead of the abstruse term XSS, wouldn't something like lack of escaping work just as well, and be much clearer? Or is there something more that the term XSS encompasses?
: Assuming we are in the middle of a HTML page, of course.