HTML

The markup language for web pages; a vector for injection when unsanitized.

HTML is the markup language that structures web page content, and its security relevance comes from how browsers render attacker influenced markup and embedded script. When user input is reflected or stored without proper output encoding, injected HTML and script enable cross site scripting that runs in the victim's session, because the browser trusts the page's origin. Mitigations include context aware output encoding, input validation, and a Content Security Policy. A common pitfall is sanitizing input but failing to encode on output, which still leaves the page exploitable.