What Is Cross-Site Scripting (XSS)?

Not all XSS attacks work the same way. Here are the three main types:

1. Reflected XSS (Non-Persistent)

This happens when a malicious script is embedded in a URL or request and then reflected back to the user. The attack only works if the victim clicks a specific link.

Example:

A hacker sends this URL in a phishing email:

PHP-template

http://example.com/search?query=<script>alert('Hacked!')</script>

If the website doesn’t properly sanitize user input, clicking this link could trigger the script in the user’s browser.

2. Stored XSS (Persistent)

This is even worse. Instead of relying on a user clicking a malicious link, the attacker injects a script directly into the website’s database—so it runs every time someone views the infected page.

• Example:

An attacker posts a comment on a blog:

"Great post! <script>stealCookies()</script>"

Now, whenever anyone visits that page, the script executes and steals their cookies.

3. DOM-Based XSS

This attack happens entirely on the client-side (in the browser), meaning it exploits vulnerabilities in JavaScript rather than the server. The script is dynamically executed based on user interactions.

Example:

If a webpage processes query parameters unsafely, an attacker can manipulate the URL:

http://site.com/?input=<script>maliciousCode()</script>

If the page injects `input` directly into the DOM, it could run malicious code in the browser.