In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of them. Is there any possible way to inject JavaScript in this case?

  • Very, very old browsers might be vulnerable if you include a newline in the search term, and it is not encoded. But I doubt you will find many users to exploit that way. – Anders May 26 '16 at 8:31


If the user input is properly encoded (HTML encoding in this context), XSS is not possible as user input will never be treated as JS code. Proper HTML encoding (conversion of input into their HTML entities) is the preferred way of preventing XSS when any user input is inserted/reflected back within HTML code.

Your example seems to be a case of DOM based XSS (where user input is never sent to the server and is inserted into the DOM directly). If this is the case, the conversion into HTML entities (HTML encoding) is being done on the client (browser) it self.

Chances are, this input is reflected back somewhere else in the response (case of Reflected XSS). Some examples where XSS can be performed in your scenario:

  • As value to another HTML attribute (HTML context) where this input is not HTML encoded.
  • As value to an event handler or declared as a JS variable within the inline script tags and given the data is not properly encoded here.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.