Find the injection

An analogy: three ways a note reaches the stage

Back at the theatre. A note can be handed up and read out straight away, once, to the person who handed it up. It can be pinned to the noticeboard and read out every night to everyone. Or the theatre's own announcer can pick it up from the lobby and read it out without the stage manager ever seeing it. Same problem, three routes.

How testers find it: a harmless marker

To check a page, put in a small, harmless piece of HTML with a unique label, such as <b id="probe-123">probe</b>, and then look at what came back. If the page now contains a real <b> element with that id, your text became markup: the page is weak. If it shows the characters <b id=... as text, it escaped them: the page is fine.

Why <b> and not a script? Because the question is "does my text turn into markup at all?", and a bold tag answers it without running anything. It also catches a case a <script> test misses: browsers do not run a <script> element inserted with innerHTML, but they do run event handlers such as onerror on inserted elements (checked October 2026). A page can look safe to a script test and still be weak.

from watched.leg3c_toypages import PracticeSite

site = PracticeSite(seed=3)
page = site.search('<b id="probe-1">probe</b>')
print(page.html)                               # what the server sent back
print(page.has_element("b", "id", "probe-1"))  # True means: weak

The toy site's three pages are site.search(q) (reflected), site.post_review(text) followed by site.reviews_page() (stored), and site.greet(fragment) (DOM-based: its own code copies the part of the address after # into a greeting). Each returns a toy page. Which ones are weak depends on the seed, so you must actually test.

The lab

Write check_site(site), which probes all three and returns {"reflected": ..., "stored": ..., "dom": ...} with True for each weak page. Then write fix_search(q): the search page's HTML, done safely.

Where each fix goes

• Reflected: escape the value in the server's template when you put it in the page.
• Stored: escape when you show the saved text, on every page that shows it (and keep storing it as typed).
• DOM-based: in the page's JavaScript, use textContent instead of innerHTML.

A common misconception

"The server's HTML is escaped, so we are safe." Not if your own front-end code later puts untrusted text in with innerHTML. DOM-based XSS never touches the server's template, which is why server-side checks miss it.

Only test what you own. Probing your own pages, or practice labs built for it, is good practice. Probing other people's sites without permission is not.

Want to go deeper? PortSwigger's free Web Security Academy has a full XSS track with its own practice labs, built for learning safely.

// weak: the text after # is parsed as HTML
const name = decodeURIComponent(location.hash.slice(1));
document.getElementById("hello").innerHTML = "Hello, " + name;

// fixed: always text
document.getElementById("hello").textContent = "Hello, " + name;

// a test for your own page: did the marker become a real element?
const weak = document.querySelector('b#probe-1') !== null;