The main difference between XSS and CSRF is the perspective:
- XSS: takes advantage of the trust the user has in a particular website
- CSRF: takes advantage of the trust the website has for the user's browser
<script>attackmeplease()</script>) but depending on the site someone can get really clever inserting it into say flash media that the user allows to run because its a video sharing site (a crude example but you get the idea, social engineering plays a part).
Some other differences are the requirements for instantiation, in one the user must visit a specific site, in the other they must use a tainted media that can come from a variety of sources, not just a site. The final point of failure is also different, in XSS the user is the last point of failure, while in CSRF the server is.
Another large difference is that a site that is vulnerable to XSS is almost certainly vulnerable to CSRF, while being protected from XSS even completely does not mean you are protected from CSRF.