Which of the following methods is MOST effective in mitigating Cross-Site Scripting (XSS) vulnerabilities within HyperText Markup Language (HTML) websites?

Antivirus and endpoint protection primarily secure the server infrastructure from malware but do not prevent client-side script injection into the web application's output, which is the core mechanism of XSS.

Placing a web system in a DMZ provides network-level isolation and security but does not address application-layer vulnerabilities like XSS, which stem from improper handling of user input within the web application itself.

While frameworks like .NET offer security features, merely using them does not automatically mitigate XSS; proper implementation of output encoding/escaping within the application code is still required to prevent such vulnerabilities.

By ensuring that all user-supplied data is properly HTML-encoded or escaped before being displayed, any injected HTML tags, such as <script>, are rendered as literal text instead of executable code. This prevents the browser from executing malicious client-side scripts, effectively neutralizing XSS attacks.