I'm having trouble understanding how a particular XSS vulnerability might arise in the real world. Guides for two of the exercises on hackthissite.org:
From searching online I get the impression that this is a fairly common attack vector, but (perhaps because my expertise is all in compiled languages) I'm having trouble imagining a realistic logging script that would involve actually executing the user agent string. Surely simply accessing
navigator.userAgent does not cause the string to be evaluated.