When I develop a site, I'm always conscious of security flaws, but I'm struggling to see how a search box could ever be used to inject script that could be ran on a page of mine.
The only time I may add some input to the page is if I render
No search results found for "<script>malicious();</script>", but I'll never let the search term run.
What am I misunderstanding here?
In fact, if anybody can explain aside from the search box concept - I'm happy with that. I'm struggling to grasp that last part of an XSS attack.