Always ask yourself : Where exactly is this data or
payload
placed?
Reflected
Stored
Mitigation :
How browser read pages
Event Handler
dang. tags