If a web application processes unchecked input data, protection mechanisms could be bypassed. This risk increases if the output data of the web application is transmitted at the same time directly to the user's web browser, to the application calling the web application, or to downstream IT systems without sufficient encoding. Such output data may contain malicious code that will be interpreted or executed on the target systems. For example, an attacker could enter JavaScript code as form data. This malicious code may then be unintentionally executed by another user's IT system.