Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to inject XSS in a JavaScript variable if a website inserts HTML encoded, user input in a double quoted string?

var userString = "perfectly "safe" input from user?";

share|improve this question
Depends on what you're going to do with the string. – Rob W Jun 26 '13 at 21:41
If nothing done with it and in script tag? – user27675 Jun 26 '13 at 22:19
up vote 4 down vote accepted

It is probably not possible to get XSS given this simple character restriction. However, an attacker could inject an escape character, for example:

var userString = "perfectly "safe" input from user?\"+"+alert(1);

In this case the attacker would be injecting a \ and an alert(1) in two different variables which existing in two locations within the <script> tag. Escape characters are a type of control character that are commonly forgotten by developers when sanitizing attacker controlled data.

... also hopefully you took this into consideration:

var userString = "</script><script>alert(1)//"
share|improve this answer
In the second example, if " is encoded into &quot;, I hope < and > are too! – Ryan O'Hara Jun 26 '13 at 23:02
@minitech the op failed to mention such a critical detail! – rook Jun 27 '13 at 2:48
HTML encoding includes &lt; &amp; &gt;, but good to know for completeness. – user27675 Jun 27 '13 at 2:59
@user27675 Yes, any character can be HTML encoded, as the HEX format &#xhhhh; supports all of ASCII and even Unicode! However, you did not mention what HTML encode function you used. – rook Jun 27 '13 at 3:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.