XSS types Stored / Reflected / DOM
Three main variants of XSS — depending on where the malicious code is stored and triggered.
Stored: saved in the database (comment field), triggered for every visitor. Worst. Reflected: in a URL parameter, triggered via a fake link. DOM-based: pure JS bug, no server touch. Defences: context-aware escaping, CSP, frameworks that auto-escape.