Sources, propagation and execution
Input can arrive through request data, stored content or client-side state. The critical step is interpretation: text passed into active HTML, script or handler contexts can acquire page execution behavior instead of remaining readable data.
Reflected and stored describe delivery, while server-side and DOM-based describe where unsafe handling occurs. OWASP notes that these classifications overlap rather than forming three mutually exclusive data-flow categories.
References: [1]
Displaying text differs from parsing HTML
Appropriate text interfaces on ordinary elements avoid reparsing input as HTML. The scope matters: textContent on a script element is not equivalent to an inert display-text area.
When authored HTML is required, escaping everything changes formatting, so suitable sanitization and allowed structures are needed. Attributes, URLs, CSS and JavaScript strings have different interpretation rules; one context’s encoding is not a universal guarantee.
References: [2]
Additional defenses do not repair unsafe data flow
Templates can protect many text insertions, but direct HTML manipulation and escape hatches need context-specific handling. Later transformations can also invalidate sanitized content, requiring inspection of the actual flow.
HttpOnly limits some cookie access and CSP adds execution restrictions without removing the injection flaw. Page-context code may still invoke user operations, so prevention concerns acquiring code authority, not only reading cookies.
References: [2]