Understanding Cross-Site Scripting: Reflected, Stored, and DOM-Based XSS Explained

Cross-site scripting (XSS) is a web security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. Reflected XSS occurs when user-supplied input from an HTTP request is immediately returned in the server's response without proper sanitization. Stored XSS, also called persistent XSS, happens when malicious data submitted by an attacker is saved and later served to other users, such as through blog comments. DOM-based XSS arises when client-side JavaScript processes attacker-controlled input, like URL parameters, and passes it to dangerous execution sinks such as eval() or innerHTML. Defenses like Content Security Policy (CSP) can reduce XSS impact, though they can sometimes be circumvented, making proper input validation and output encoding essential.