Tags, not text
If the app escaped your input, < would come back as < and show as literal text. Send a tag and see what happens:
curl -s 'http://127.0.0.1:8080/app/search?q=<b>bold</b>'In the terminal
student@vulntech:~$ curl -s 'http://127.0.0.1:8080/app/search?q=<b>bold</b>' <!doctype html><title>Search</title><h1>Search</h1><form action='/app/search'><input name='q' value='<b>bold</b>'><button>Go</button></form><p>Results for: <b>bold</b></p><p>No results found.</p>
The <b> comes back as a real tag. So does a <script>:
curl -s 'http://127.0.0.1:8080/app/search?q=<script>alert(1)</script>'In the terminal
student@vulntech:~$ curl -s 'http://127.0.0.1:8080/app/search?q=<script>alert(1)</script>' <!doctype html><title>Search</title><h1>Search</h1><form action='/app/search'><input name='q' value='<script>alert(1)</script>'><button>Go</button></form><p>Results for: <script>alert(1)</script></p><p>No results found.</p>
Your <script> is reflected verbatim into the page. In a real browser (not curl) that script would run — that's reflected XSS. An attacker sends a victim a crafted link and their script executes in the victim's session: stealing cookies, making requests as them, defacing the page.