This question already has an answer here:
I'm trying to understand how XSS works, and I bumped into Google's XSS games (https://xss-game.appspot.com/).
Level 1 is easily solvable with the most common XSS (
<script>alert(0)</script>). However, if you try this on level 2 it doesn't work. It is solvable loading an img with the alert code inside an
onerror: attribute. However, I'm trying to understand how does it filter the script tags, and after putting them, I see them in the servers response EXACTLY how I entered them (but with no alert message). As I understand it, if the browser sees an
<script>alert(0)</script>, it always executes it. All the solutions for XSS that I know of involve filtering the content before displaying it.
So my questions are, how is Google preventing the XSS to work, and under which conditions would a browser see HTML code with
<script>alert(0)</script> and not execute it?
Edit: the first question was a duplicate, and the answer is by putting the content inside an innerHTML. However, the second question remains, is there any other way to implement this?