What application behavior makes the lab's reflected XSS examples possible?
The browser connects to a nonstandard TCP port.
User-controlled input is inserted into the page in a context where the browser interprets it as active HTML or JavaScript.
The server encrypts the input before returning it.
The input is stored only in a database and never appears in a response.