Which of the following is the BEST approach to prevent Cross-site Scripting (XSS) flaws?

Digital certificates secure server authentication and encrypt transport via TLS, but do not prevent XSS, which exploits how a server processes and reflects user input back to the browser.

Verifying access rights is an authorization control that governs what authenticated users may access, but does not sanitize user input or prevent script injection into web pages.

Checking access rights before exposing UI controls addresses authorization, not the injection of malicious client-side scripts caused by unescaped user input.

XSS attacks occur when untrusted input is sent to a browser without proper sanitization, allowing malicious scripts to execute in the victim's session. Validating input on the server side and HTML-escaping output ensures user-supplied content is treated as plain text rather than executable code, which is the primary mitigation strategy recommended by OWASP.