I've noticed that the following Stored XSS does not execute, whereas in the JS console it works:
<img src=0 onerror=alert(document.domain+": "+Date.now())>
This doesn't prompt an alert box. Whereas the following do:
<img src=0 onerror=alert(Date.now())>
<img src=0 onerror=alert(document.domain)>
Casting any of the elements with String()
doesn't help either.
The plain alert statement (alert(document.domain+": "+Date.now())
) works in the Chrome JS console, in Firefox it works if I add the semicolon at the end.
I'm certainly no JS wizard, but I don't see why this doesn't work.
Why does the initial XSS via the image tag not work?