Reflected XSS

Hello new user!

Enter your name:

How to do it

Try entering <script>alert(1)</script> as your name. (it won't work!)
.innerHTML no longer runs <script> tags but you can use another payload <img src='x' onerror='alert(1)'>

How is it different

Why is this different from stored? This one uses the URL to load the payload. This URL on any browser will trigger the XSS

Real world examples

Pretty much similiar to this example from article names or other things.

For more go to Portswigger