Comparison
Reflected XSSvsStored XSS
Reflected XSS
the search term from the query string was echoed back into the page without being escaped.
The variant where the payload arrives in the request and is echoed straight back in the response. It requires the victim to follow a crafted link, which makes it narrower than the stored kind and still perfectly effective in a phishing email. Error pages and search result headings are where it usually hides, because those are the strings nobody thinks of as user input.
Full entry →Stored XSS
the payload was saved in the database and fired for every visitor who opened the page afterwards.
The variant where the injected content is persisted server-side and served to everyone who views it. It is the most damaging kind because it needs no interaction from the victim and reaches every user of the affected view. It also outlives the fix: patching the escaping does not remove what is already stored.
Full entry →