Which of the following is one of the most effective ways to prevent Cross-site Scripting (XSS) flaws in software applications?

Security policies and procedures are administrative controls that define intent but do not technically prevent script injection in application code.

Digital certificates authenticate the identity of a server using TLS/PKI but have no effect on whether the application sanitizes user input.

XSS attacks succeed when untrusted data is included in a web page without proper validation or output encoding, allowing browsers to execute injected scripts. Input validation rejects malformed or malicious data before processing, while output escaping (HTML entity encoding) ensures that special characters like < > and & are rendered as text rather than interpreted as HTML or JavaScript. Together, these two controls directly neutralize the mechanism by which XSS payloads are injected and executed.

Verifying access rights before displaying UI controls is an authorization control that prevents privilege escalation, not script injection.