What is a common mistake when working with cross-site scripting XSS?

A common mistake with cross-site scripting XSS is input validation alone does not prevent XSS because safe handling depends on the output context where the data is inserted. The safer approach is to design and test the behavior explicitly rather than assuming the platform or dependency will handle it automatically.