XSS Cross-Site Scripting — Three Attack Patterns

Reflected, Stored, and DOM-based XSS have entirely different data flows, but the fatal trust boundary is the same: treating user input as executable code.