What you need to know
Cross-site scripting happens when untrusted content is interpreted as executable markup or script. React escapes ordinary text by default, but unsafe HTML rendering and third-party scripts can bypass that protection.
How to apply it
Render user text normally, sanitize rich HTML with a maintained sanitizer, and review every use of dangerouslySetInnerHTML. Add a content security policy where it fits the deployment.
Common mistake to avoid
Do not write a home-grown HTML sanitizer. Keep dependencies updated and encode output for the context in which it is used.