How XSS works
Sinks, reflection, and why context decides the payload.
Cross-site scripting is an output problem: untrusted input reaches a page without encoding, and the browser cannot distinguish the site's script from the attacker's. Where the input lands decides everything — HTML body, attribute, JavaScript string, URL — because each context needs different characters to break out.
Three delivery shapes. Reflected: the payload arrives in the request and bounces off the response immediately, needing the victim to open a crafted link. Stored: the payload is saved (a comment, a profile) and fires for every later visitor — no link needed. DOM-based: the page's own JavaScript writes attacker-controlled data into the document, sometimes with the server never seeing it.
The fix is output encoding matched to context, plus defense in depth: HttpOnly cookies the script cannot read, and a Content-Security-Policy that constrains which scripts may run at all.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.