XSS: stored, reflected and DOM-based

February 14, 2026 · 1 min read · #web #xss #javascript

Cross-site scripting is attacker code executed in another site's context: it steals cookies, sessions, performs actions as the user.

The three variants

Reflected: the payload is in the request and comes back in the response (?q=<script>...). It needs the victim to click a link.

Stored: the payload is saved on the server (a comment) and hits every visitor. The most serious.

DOM-based: no server involved, client-side JavaScript writes untrusted input into the DOM:

document.getElementById('out').innerHTML = location.hash;

Defence

Context-aware encoding: HTML entities for the body, attribute-encoding in attributes, JS-encoding inside script. Use safe APIs (textContent, not innerHTML). A strict Content-Security-Policy limits the blast radius even if a payload slips through.

« back to home