<aside>

Reflected

stored

Dom-based

defeat it by use html special char

</aside>