If a website URL gets encoded then is the website still vulnerable to XSS or no?

For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)%3C%2Fscript%3E does this mean the site is vulnerable to XSS or no?

  • The answer depends on what the webapplication does with the URL-encoded payload. Are you assuming a scenario of the type echo urlencode(payload)?
    – Anders
    Sep 25, 2018 at 10:55

2 Answers 2


The answer depends on how the page renders your payload.

If the target is a HTML page and the payload still appears as <script>alert(1)</script>, an XSS will occur, assuming no CSP or Chrome's XSS auditor. However, if the HTML page renders your payload in the URL syntax i.e. %3Cscript%3Ealert(1)%3C%2Fscript%3E, there won't be an XSS. Depending on where the payload is injected in the latter, I would also try special characters like " and ' to try escape the URL context to inject directly into the HTML (url) tag.

  • The htmlentities() function and the htmlspecialchars() function, both of which I believe to be used in this parameter, will not allow escaping. Jul 27, 2018 at 10:16

In that particular example, that parameter would not be vulnerable to XSS.

It does depend, you aren't giving a load of information, but generally speaking that seems to be something like: htmlspecialchars(htmlentities($input)) which is incredibly safe.

This does not mean that the SITE is not vulnerable, it just means that this parameter in particular seems to be safe.

This still depends, is the parameter injecting your input into a link, iframe, image, etc? If it is injecting within another element, it may be possible regardless using methods such as javascript: and data:.

  • Actually my xss payloads was reflected on the page. The site Url encode my payloads like %3Cscript%3Ealert(1)%3C%2Fscript%3E Jul 27, 2018 at 0:11
  • 1
    In that case, they are using the htmlentities() function, but are printing it raw, which means it is also going through a function such as htmlspecialchars(). This is not possible to get XSS in the way you described. Doesn't mean the entire site is secure, but it does mean this parameter would be. Jul 27, 2018 at 10:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.