Comparison
DOM-based XSSvsReflected XSS
DOM-based XSS
the server never saw the payload, because the script read it from the URL fragment and wrote it into the page.
The variant where the injection happens entirely in the browser: a client-side script reads a source it does not control and writes it into a sink that executes it. Because the payload can live in the fragment, it may never reach the server, so server-side logging and filtering see nothing. The sinks are the list to know — `innerHTML`, `document.write`, `eval`, and framework escape hatches like `dangerouslySetInnerHTML`.
Full entry →Reflected XSS
the search term from the query string was echoed back into the page without being escaped.
The variant where the payload arrives in the request and is echoed straight back in the response. It requires the victim to follow a crafted link, which makes it narrower than the stored kind and still perfectly effective in a phishing email. Error pages and search result headings are where it usually hides, because those are the strings nobody thinks of as user input.
Full entry →