Inject servers like injectserver.com succeed because they exploit a core feature of the web: the ability to load remote code. The browser sees the script as part of the original page, grants it the same permissions, and executes it.
