Hook

What if an attacker could execute JavaScript inside your users’ browsers — using nothing more than a comment box?

That’s exactly what Cross-Site Scripting (XSS) enables.

Let’s break down how this actually happens in real applications.

What is XSS?

The flow of a typical XSS attack is illustrated above.

Cross-Site Scripting happens when an application renders untrusted user input directly into a web page.

Instead of displaying the input as plain text, the browser interprets it as executable JavaScript.

This allows attackers to run malicious code in another user’s browser — under your application’s trusted domain.

Types of XSS

✔ Stored XSS

Attacker submits malicious input.

Application stores it in database.

Every user who loads the page executes it.

Example scenario:

Comment section

✔ Reflected XSS

Input comes from request (URL/form)

Reflected immediately

Example:

Search page

✔ DOM-based XSS

No server involvement.

Client-side JavaScript inserts attacker-controlled data into…