It is obviously not enough to escape \ ' " in on-attributes:
onclick='alert("[variable]")' variable: hello, world"); alert("XSS result: alert("hello, world"); alert("XSS")
result: onlick='alert("hello, world&quot;); alert(&quot;XSS")'
In <script> tags, however, different rules apply in Firefox:
Skipping html escaping in script-tags, however, is not an option:
The first script tag creates an syntax error because of the missing ". But in Firefox the injected second script tag is executed.