Which of the following is the BEST approach to prevent Cross-site Scripting (XSS) flaws?

Digital certificates authenticate servers for encrypted transport (TLS/SSL) but do not prevent malicious scripts embedded in web page content from executing in the browser.

Verifying access rights before granting access to protected resources is an authorization control that prevents privilege escalation, not XSS injection.

This choice is identical to B and addresses authorization, not XSS prevention through input validation and output encoding.

XSS attacks occur when untrusted data is sent to a browser without proper validation or escaping, allowing attackers to inject client-side scripts. Validating input to reject unexpected data and escaping all output before rendering it in the browser neutralizes this attack vector by ensuring user-controlled data is never interpreted as executable code. This is the primary defense recommended by OWASP for XSS prevention.