Directly writing user input (for example, an HTTP request parameter) to an HTTP response without properly sanitizing the input first, allows for a cross-site scripting vulnerability.

This kind of vulnerability is also called reflected cross-site scripting, to distinguish it from other types of cross-site scripting.

To guard against cross-site scripting, consider using contextual output encoding/escaping before writing user input to the response, or one of the other solutions that are mentioned in the references.

The following example code writes part of an HTTP request (which is controlled by the user) directly to the response. This leaves the website vulnerable to cross-site scripting.

Sanitizing the user-controlled data prevents the vulnerability:

OWASP: XSS (Cross Site Scripting) Prevention Cheat Sheet.

OWASP Types of Cross-Site Scripting.

Wikipedia: Cross-site scripting.