Is there a possible way to write a payload which can bypass filtering of ', ", < and >? As far as I know, it's javascript:alert() as this uses none of the above. So should it work if I use that in an input field where all the above mentioned chars are filtered?

I have a field like this:

<input type="text" name="name" value=''></input>

Now I have to close the quote at value and put my string (e.g. ' onload=javascript:alert()), but that single quote doesn't show up in the source of my resource.

  • If single quotes are filtered and your injection point is inside the value attribute you have no way of injecting JS. – Arminius Apr 6 '17 at 21:52
  • It may be bypassed if encodings are messed up. Saying input is UTF-8 and encoding is UTF-8, then it won't escape multibyte characters containing 0x27 byte (the ' but I don't know if such byte can appear in UTF-8 multibyte characters). If the client interprets the HTML as ASCII/latin1 then it may end up reading the multibyte as multiple characters, one being the closing ' – Xenos Apr 7 '17 at 12:19

No, XSS cannot work here without a single quote.

In javascript:alert(), the first part is the javascript protocol. You need to be in a URL context for it to work (eg inside an href attribute). It will also work - but not be necessary - in an Event Attribute (eg onload).

To perform XSS in your context, you need to be able to exit the string context of the value attribute. To do this, you need single quotes. If they are properly filtered, there is no XSS here.

(There is a slight change that the filter is not working properly; filtering may for example be done first, after which the input is handled further - eg decoded from some format - which might allow you to bypass the filter; but if you cannot bypass the filter and inject a single quote, you cannot perform XSS).


The previous answer to this question, as far as I'm aware is wrong. You can bypass single quotes by using functions that do not result in void return values.

For example

<img src=javascript:eval(alert(new Data.now()))>

This would trigger an XSS alert with no quotes required.

  • would your example work in the value field in the OP's scenario? – schroeder May 18 '18 at 14:01
  • the value field is irrelevant without more information on what is happening to the form after submission. For xss, it is usually how this form is then displayed on the following screen that allows for the actual alert to show up – Dimi Tree May 22 '18 at 4:19
  • for example <input name='foo' value=''> on the next screen this is rendered as <span>(then foos value is placed here)</span> What can turn this input into an XSS is whether the input field was either not sanitised, not filtered or there was no handelling of JS escape characters – Dimi Tree May 22 '18 at 4:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.