A web page is just HTML that some server generated, and generating it means gluing your data into a string and handing it to a browser. You can probably guess how this goes. When an app drops your input into that HTML without escaping it, the browser can't tell your markup from the page's own, and it runs whatever you sent. Data becomes code.
That's Cross-Site Scripting, and the twist that makes it nasty is who ends up paying for it. The victim isn't the server this time, it's another person using the site. Code you slip onto a page runs in their browser, on their session, with everything they can see and do.
It comes in three shapes. Reflected, where your input bounces straight back in the response. Stored, where the app files it away and serves it to whoever loads the page later. And DOM-based, where the server never even sees it and the page's own JavaScript does the damage. We'll work through all three, and then through the filters people throw up to stop them, which have a way of not quite holding.
