Why do XSS strings often start with ">?

Question

One of the ways, XSS can be exploited, is to use following tag:

"><script>alert(document.cookie)</script>

Here, What is the meaning of "> before script (<script> tag) and why it is used?

Answer 1

This way you escape from a double-quoted attribute (") and close the previous tag (>) before opening a script tag that contains your payload. It's one of the most basic XSS patterns.

Example:

<input type="text" value="$XSS">

With your sequence it becomes:

<input type="text" value=""><script>alert(document.cookie)</script>">
 ^- a completed tag                  ^- payload           garbage -^

Note that your vector only works if HTML entities aren't filtered.

So if you can't escape from that attribute, it's XSS-safe. This doesn't trigger:

<input type="text" value="<script>alert(document.cookie)</script>">

You can see the same idea with XSS inside Javascript (e.g. '); to end a string and a function call) or with SQL injections. The first characters of an injection sequence often have the purpose of escaping from the current context.

As for @Mindwin's obligatory SQL injection xkcd strip, I freehand-circled the part I'm referring to: