I was reading the basics of XSS prevention on owasp xss rules. But the issue is rather abstract. The term "untrusted data" is often used. Every rule reminds not to insert untrasted data in the certain places in the page content like:
tag names and so on...
But what is untrusted data? E.g. i'm sending data (user name) from the serverside that has been extracted from database. Is this data going to be trusted data?
E.g. the user submits the form and sends the text input value or the client makes any request (with parameters or not). Is this data going to be untrusted one?