Prove the XSS
The search page reflects your q parameter into its HTML. Prove it doesn't escape your input by getting a <script> tag to come back intact.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
Your script tag survived into the page unescaped, which in a real browser means arbitrary JavaScript runs in the victim's session. You've demonstrated reflected XSS. The fix lives on output, not input: HTML-encode untrusted data for the exact context it's written into, and add a Content-Security-Policy so injected script can't easily run.
Show solution
cd /home/student
curl -s 'http://127.0.0.1:8080/app/search?q=<script>alert(42)</script>' -o xss.txt
grep -o '<script>alert(42)</script>' xss.txt