Lab: reflected greeting
A guestbook echoes your name unencoded. Prove it executes.
The guestbook prints the name parameter straight into the page. View a normal greeting first, then submit markup instead of a name: if the response contains your tags unencoded, the browser would execute them for every visitor who opens the link.
Read the sink, confirm normal behavior, then reflect a script tag. The output tells you plainly what a browser would do with it.
That was the whole lesson.
A free account adds the interactive part: the marking quiz, the lab if this lesson carries one, live progress, the timed exam, and a certificate employers can verify.