How does reflected server-side XSS work, and why does it need a crafted link when stored XSS does not?
The payload rides in the request, the server echoes it straight back into the response, and it executes on render — nothing is saved, so each victim has to be lured into sending the request themselves.
* Reflected XSS flow — the payload rides in the request, is echoed back by the server, and executes when the response renders; it is never stored. *
Reflected XSS is the same bug as stored XSS with the persistence removed. A page greets whoever is named in the query string:
<p>Hello ${param.name}!</p>
Request …/hello?name=Bob and the page says "Hello Bob!". Request
http://…/hello?name=<script>alert(1)</script>
and the server pastes those characters into the HTML unchanged, so the browser receives a real <script> element and runs it. The payload made a single round trip — in on the request, out on the response — and was never written to any database.
Why that changes the attack, not the bug:
| Stored | Reflected | |
|---|---|---|
| Where the payload waits | in the server's data store | nowhere — it is re-sent every time |
| How victims are reached | they simply visit the page | each one must be induced to send the crafted request (a link in an e-mail or chat, an ad, a redirect) |
| Blast radius | everyone who loads the page | one victim per successful lure |
So reflected XSS needs a delivery step, which is why it usually arrives as a long, URL-encoded link — %3Cscript%3E… — designed not to look alarming. Sites often help by echoing input in exactly the places users expect to see it: error messages, search-result headings ("no results for …"), and other page content built from the request.
The fix is identical to stored XSS, which is the real point: encode untrusted data for its output context when rendering. Where the data came from — a database row or this request's query string — never changes what the browser does with an unescaped <.
Go deeper:
PortSwigger — Reflected cross-site scripting — delivery, impact and labs for the reflected case specifically.