I was using Burp Suite for some testing and I noticed that they included the following string:
as an attack string for an XSS payload.
How could this string be used to execute a XSS attack?
In this case the first
This is assuming the target application has a broken escape routine.
I am not sure about this scenario, but think of it like this.
In that situation, the Script tags are not necessey, but only the code will work as an XSS. For such a situation, the code \";alert('XSS');// will be neccessary. Just sharing a thought.