title: How XSS attack really works?
body: <p>So, preventing website from XSS attack is very simple, you just need to use <code>htmlspecialchars</code> function and you are good.<br>
  But if developer forgot to use it, what can attacker/hacker do? He can get your session_id, right? And here is a question. What can he do with that?<br>
  Thank you very much.</p>