My attack vector is being passed in three contexts.
- HTML element:
- HTML attribute value:
<script> var a = "injection"; </script>
In all these contexts, my payload is rendered as HTML-encoded values (single-quotes, double-quotes, angle brackets). I am aware this pretty much rules out XSS exploitation through the first two contexts, but is the third context also secure?