" is properly escaped there is no way to get beyond the HTML attribute value.
Your browser parses HTML as a state machine. To verify which state transitions are possible with your available characters, you can look up the state in the HTML5 syntax specification. In your case, these are the options:
18.104.22.168 Attribute value (double-quoted) state
Consume the next input character:
U+0022 QUOTATION MARK (")
Switch to the after attribute value (quoted) state.
U+0026 AMPERSAND (&)
Switch to the character reference in attribute value state, with the additional allowed character being U+0022 QUOTATION MARK (").
Parse error. Append a U+FFFD REPLACEMENT CHARACTER character to the current attribute's value.
Parse error. Switch to the data state. Reconsume the EOF character.
Append the current input character to the current attribute's value.
As you can see, the only way to get out of the quoted Attribute value state is via the corresponding quotation mark (
' respectively). Any other character just adds to the current attribute's value. Even angle brackets and control characters have no special meaning inside an attribute.
So, in this particular case it's also irrelevant how
> are handled. This does not trigger:
<input type="text" value="<script>alert('No bounty for you.')</script>">