I was wondering if appending a double quote at the end of a query is considered a valid XSS filter. Let's say we have a search function and I entered:
If I look at the source of the resulting query I will see the following:
<input name="search" type="text" value=""><script>alert('hi')</script>">
The double quote will be appended automatically at the end of my query.
Assuming that the filter also scrubs out the null char, and HTML comments
<!--, would this be an effective XSS filter or is this just wishful thinking?