Cross$-$Site Scripting $($XSS$)$ vulnerabilities happen primarily because $....$

Question $20$ options:

browsers retain cookies

PHP is weakly typed

data from any untrusted source is not properly encoded

input validation is done wrong