Cross-site scripting has been a top web vulnerability for over twenty years and it is still one of the most common criticals we report. Here is how reflected, stored, and DOM XSS work, how we test for them, and the defenses that hold up.