Which of the following is one of the most effective ways to prevent Cross-site Scripting (XSS) flaws in software applications?

Security policies and procedures are administrative controls that define standards but do not technically prevent the injection of malicious scripts into web pages.

Digital certificates authenticate the server's identity via TLS/SSL but have no mechanism to inspect or sanitize user-supplied input for script injection.

XSS attacks occur when untrusted data is sent to a browser without proper validation or escaping, allowing attackers to inject malicious scripts. Validating input on the server side ensures data conforms to expected formats, while output encoding or escaping neutralizes script characters (such as converting < to &lt;) so the browser renders them as data rather than executable code. Together, these two controls directly address the root cause of XSS as defined by OWASP.

Verifying access rights is an authorization control that restricts what authenticated users can do, but it does not prevent malicious script payloads from being injected and reflected to other users.