An organization needs to protect its PHP web applications from Cross-Site Scripting attacks. Which action should they take?

Parameterized queries prevent SQL injection by separating code from data in database queries; they have no effect on XSS, which targets the browser rendering layer.

Adding a random element to session cookies mitigates session fixation and CSRF attacks, not script injection through unvalidated input.

Two-factor authentication hardens account login security but does not prevent an attacker from injecting malicious scripts into application output.

XSS vulnerabilities arise when untrusted input is reflected or stored and then rendered in a browser without sanitization. A well-maintained third-party library such as HTML Purifier for PHP enforces consistent input filtering and output encoding across the application. This directly eliminates the attack vector by stripping or escaping malicious script content before it reaches the DOM.