Reflected Input

Definitions

1. User-supplied data that is immediately returned by an application in a response, page, or error message rather than being stored for later use. Reflected input becomes dangerous when it is not safely encoded and can be interpreted as active content in the receiving context.

   In plain English: Input from a user that is sent straight back in a response.

   Example: "The search page echoed reflected input directly into the HTML title, which turned a simple query parameter into an XSS vector."

Related Terms

• XSS
• CSRF
• OWASP
• Content Security Policy
• Blind XSS
• Cookie Security
• Malvertising
• Request Forgery
• Request Validation
• Reverse Proxy Security