XSS: understand the context before testing
HTML, an attribute or JavaScript? The same string behaves differently depending on where it appears.
Trace the data flow
Identify where input originates and where it appears in the browser. Reflected values, stored comments and data handled by client-side code require different observations. Start with a unique text marker to locate the output.
Identify the context
HTML text, attribute values, URLs and JavaScript follow different parsing rules. Seeing your marker in the page source does not prove code execution. What matters is how the browser interprets that particular location.
Confirm without collecting someone else’s data
In a training environment, use a harmless visible execution marker. Do not collect cookies or perform actions on behalf of other users. For stored input, plan cleanup so the test does not remain active after the assessment ends.
Remove unsafe interpretation
Use safe text-output APIs and context-appropriate encoding. If the product intentionally allows HTML, apply suitable sanitization. Content Security Policy provides an additional layer, but does not replace fixing unsafe output handling.