\n\nand the server pastes those characters into the HTML unchanged, so the browser receives a real

LOGBOOK

HELP

Quiz Entry - updated: 2026.07.31

How does reflected server-side XSS work, and why does it need a crafted link when stored XSS does not?

The payload rides in the request, the server echoes it straight back into the response, and it executes on render — nothing is saved, so each victim has to be lured into sending the request themselves.

Reflected XSS request/response flow: payload in the URL, echoed into the response, executes on render.

* Reflected XSS flow — the payload rides in the request, is echoed back by the server, and executes when the response renders; it is never stored. *

Reflected XSS is the same bug as stored XSS with the persistence removed. A page greets whoever is named in the query string:

<p>Hello ${param.name}!</p>

Request …/hello?name=Bob and the page says "Hello Bob!". Request

http://…/hello?name=<script>alert(1)</script>

and the server pastes those characters into the HTML unchanged, so the browser receives a real <script> element and runs it. The payload made a single round trip — in on the request, out on the response — and was never written to any database.

Why that changes the attack, not the bug:

Stored Reflected
Where the payload waits in the server's data store nowhere — it is re-sent every time
How victims are reached they simply visit the page each one must be induced to send the crafted request (a link in an e-mail or chat, an ad, a redirect)
Blast radius everyone who loads the page one victim per successful lure

So reflected XSS needs a delivery step, which is why it usually arrives as a long, URL-encoded link — %3Cscript%3E… — designed not to look alarming. Sites often help by echoing input in exactly the places users expect to see it: error messages, search-result headings ("no results for …"), and other page content built from the request.

The fix is identical to stored XSS, which is the real point: encode untrusted data for its output context when rendering. Where the data came from — a database row or this request's query string — never changes what the browser does with an unescaped <.

Go deeper:

From Quiz: SPRG / Input Validation & Output Encoding | Updated: Jul 31, 2026