I'm testing a web application, when I send an input data to web application, this places the data in an
onclick function, something like this:
<a href="#" onclick="someFunction('dataFromServer', '0');">link</a>
But, the web application transforms that data from lowercase to uppercase, then if I replace
','0');alert('XSS');someFunction(', I have the following result:
<a href="#" onclick="someFunction('','0');ALERT('XSS');SOMEFUNCTION('', '0');">link</a>
So, my XSS exploit doesn't work, because, the browser says "ALERT is undefined", I have tested on Firefox and IE.
Is there some way to execute a XSS in this case?