Frontend & browser·Browser security
the server never saw the payload, because the script read it from the URL fragment and wrote it into the page.
DOM-based XSS
Also calledclient-side XSS
The variant where the injection happens entirely in the browser: a client-side script reads a source it does not control and writes it into a sink that executes it. Because the payload can live in the fragment, it may never reach the server, so server-side logging and filtering see nothing. The sinks are the list to know — `innerHTML`, `document.write`, `eval`, and framework escape hatches like `dangerouslySetInnerHTML`.