Explain stored, reflected and DOM-based XSS.

The three types differ in where the payload lives.

Stored XSS: the server saves the payload, for example in a comment or a profile name. Then it serves it to everyone who views that page. This is the most damaging kind, because victims only need to visit the page.

Reflected XSS: the payload is in the request, usually a URL parameter. The server echoes it back in the response. For example, a search page prints Results for <img src=x onerror=alert(1)>. The attacker must get the victim to open a crafted link.

DOM-based XSS: the flaw is entirely in client-side code. The code reads data from a source like location.hash and writes it to a dangerous sink like innerHTML. The server may never see the payload.

The defence is the same in every case: encode or sanitise untrusted data for the context where it's rendered.