Learn the ins and outs of broken access control vulnerabilities and how to find them in your security research.

TL;DR Reflected input is often unexploitable because the attack ends up in a place which stops it working, such as inside a quoted attribute.