Reflected XSS

He knows the search terms in the URL will get displayed back on the search results page, and he wonders if they are escaped properly.

The hacker
www.welp.com?search=taco
The logo A shrug
The indifferent restaurant review site
Search results for "taco"
A taco
Dynamite Taco
A rating
This place sells tacos, I reckon.
A taco
Tacos Deluxe
A rating
Yup. Tacos here too.