So I'm evaluating a notoriously safe website for XSS exploit, but I've noticed something interesting. They ban HTML number entities ({) but not the letter kinds (<).
With the "letter" kind, it parses on the website and I can input <script> and all that, but it doesn't run.

This is my problem:
It's reading the input then as a string and even if I escape the span with </span>, it doesn't do anything.

A visual of what I'm talking about is:
<span class="sanitizedtext">[INPUT HERE]</span>

Even if I use tags, it does this:
<span class="asdf"></span><script>[my code here]</script><span></span>

While the above should break and execute, it doesn't. It just sits there, even if it's returning on the page.

I found a way to make a page accept <script>, but it just sits there because it's being read as a string, not code. (Even if I try to escape the span/div/whatever)

Sorry if I'm just bad at XSS. Thank you all in advance!

  • 1
    Fixed formatting and added TL;DR
    – Ryn Fox
    Nov 26, 2016 at 17:28

2 Answers 2


It is fine if a web page does not filter strings like &lt; because it is escaped already. Browsers know that &lt;script&gt; is not an actual script tag, but just text.


user7091295 is right. If you look at the source of the web page, it will look like &lt;script&gt; and you will understand that &lt; is the encoding for left angle bracket, de-weaponized already and the tag won't be a tag. You are sort of doing the web site's defense for it. You should look at other tags besides script What is the result of img, a, iframe, and other tags mentioned here: https://html5sec.org/ ?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .