توضیح عملکرد حملات xss

<?php
if (isset($_GET['par1']) && !empty($_GET['par1']))
{
echo $_GET['par1']."<br>";
}

if (isset($_GET['par2'])&& !empty($_GET['par2']))
{
echo $_GET['par2']."<br>";
}

if (isset($_GET['par3']) && !empty($_GET['par3']))
{
echo $_GET['par3']."<br>";
}

?>

<form action="<?php echo $_SERVER['PHP_SELF'];?> ?>" method="get" >

input 1: <input type="text" name="par1">
<br>
input 2: <input type="text" name="par2">
<br>
input 3: <input type="text" name="par3">

<input type="submit" value="send">
</form>
</body>