2.1 Anatomy of a cross-site scripting attack2.2 Preventing cross-site scripting2.2.1 Understanding the same-origin policy2.2.2 Escaping HTML2.2.3 Escaping in a different context2.3 Content Security Policy2.3.1 Sample application2.3.2 How Content Security Policy works2.3.3 Refactoring applications for Content Security Policy2.3.4 Content Security Policy best practices2.3.5 Content Security Policy Level 3 features2.4 More browser safeguardsSummary