Recently, during a security audit, I found a page in which some URL parameter is reflected inside a <script> tag. It could be an easy XSS, but a line before the reflection there is a syntax error (e.g., string without ending quotes).

Is it possible to make JavaScript code run in spite of a syntax error one or more lines above it?

1 Answer 1


If there is a syntax error inside a script tag, no code in the block will be executed, neither above or below it. So to get some code running, you have two options:

  • Fix the syntax error using the code you are injecting. Depedning on what kind of error it is, this may or may not be possible. E.g. closing a quote two lines up sounds impossible, but balancing brackets should be doable.
  • End the script tag with the syntax error, and start a new clean one. If there is no filter at all you can inject e.g. <script>alert("XSS");</script><script>-

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .