<body onload='doSomething ("userdata")'>
where the server HTML encodes the userdata before writing the HTML over the socket to the browser.
it would now be executed. For the life of me, I can no longer find the relevant references that demonstrate this behavior, nor can I remember whether parsing order has other subtleties - like if HTML encoding styles or URLs will result in XSS vulnerabilities. Or if there are parse order issues with encoding between URL, CSS and JS.
What references demonstrate that encoding with which mechanisms in the wrong context will result in continued XSS vulnerabilities, and which will result only in usability issues?