Explain the differences between XSS and CSRF and how to prevent them.

XSS: An attacker secretly inserts a command script into your book, causing anyone who reads it to follow the instructions (executing strange code on the page). CSRF: An attacker forges your signature to send commands to the bank, exploiting the fact that the bank already trusts you (leveraging your session cookie).