title: What is cross site scripting?
body: <p>On <a href="http://www.acunetix.com/websitesecurity/cross-site-scripting/" rel="noreferrer">this site</a> (<a href="https://web.archive.org/web/20130320195518/http://www.acunetix.com/websitesecurity/cross-site-scripting/" rel="noreferrer">archived snapshot</a>) under “The Theory of XSS’, it says:</p>
  
  <blockquote>
    <p>the hacker infects a legitimate web page with his malicious client-side script</p>
  </blockquote>
  
  <p>My first question on reading this is: if the application is deployed on a server that is secure (as is the case with a bank for example), how can the hacker ever get access to the source code of the web page? Or can he/she inject the malicious script without accessing the source code?</p>