In a search box (
<input value=" *insert search term here* "...>), when I input
If the user input is properly encoded (HTML encoding in this context), XSS is not possible as user input will never be treated as JS code. Proper HTML encoding (conversion of input into their HTML entities) is the preferred way of preventing XSS when any user input is inserted/reflected back within HTML code.
Your example seems to be a case of DOM based XSS (where user input is never sent to the server and is inserted into the DOM directly). If this is the case, the conversion into HTML entities (HTML encoding) is being done on the client (browser) it self.
Chances are, this input is reflected back somewhere else in the response (case of Reflected XSS). Some examples where XSS can be performed in your scenario:
- As value to another HTML attribute (HTML context) where this input is not HTML encoded.
- As value to an event handler or declared as a JS variable within the inline script tags and given the data is not properly encoded here.