HTML CONTEXT / REFLECTED INPUT
Reflected XSS
A value arrives in the URL, gets reflected into the response, and reaches an HTML sink without being encoded.
// live demo
Hello, operator.
This greeting is built from the q query parameter.
// try this payload
<img src=x onerror=alert('reflected')>
show the answer
Test URL: append ?q=%3Cimg%20src%3Dx%20onerror%3Dalert('reflected')%3E to this page.
Why it works: the page reads attacker-controlled q and inserts it with innerHTML. The browser parses the value as markup, so the image error handler runs.
Fix: use textContent when the value is text. If HTML is genuinely required, allow-list safe markup with a vetted sanitizer.
show the vulnerable line
greeting.innerHTML = `Hello, ${query}`;