Cross-Site Scripting (XSS)

When it applies

Any place your input reaches the response or the DOM without correct context-aware output encoding: reflected (in the immediate response), stored (saved then rendered to others), or DOM-based (client-side JS writes attacker data into a sink).

Why it works

The browser can't tell your data from the page's own markup/script. If input lands in an HTML context and the app doesn't encode < > " ' & for that exact context, your bytes become new elements, attributes, or script. Filters usually fail because they encode for the wrong context (HTML-encode but you're in a JS string, or in an attribute, or in a URL).