I have a webpage in which Email is given as input. It will then display "your email is [email protected]". I am then changing the email in URL to <script>alert(1)</script> and send tbe request again. The system now displays "your email is <script>alert(1)</script>". Only the display message is like this. Script doesn't seem to get executed. Is this XSS vulnerability or just email validation issue?

  • 1
    If the script doesn't get executed maybe the payload is not good..maybe this is not an XSS issue, how's your DOM arranged ? Commented Feb 28, 2019 at 14:10
  • It is a third party website and I am testing it. Not sure about DOM. Will check that. Commented Feb 28, 2019 at 14:20
  • inspect it as html if possible , it might just be html encoded so its safe to display
    – Bokis
    Commented Feb 28, 2019 at 15:05

1 Answer 1


There could be many reasons the script is not being executed:

  • It is being blocked by a browser filter or a CSP. If this is the case, it would not be displayed on the page, but it would be part of the source code.
  • The fake email is properly encoded. If this is the case, you would see it as e.g. &gt;script&lt; in the source but <script> in the page.
  • It is being inserted into the DOM with JavaScript using a safe method like textContent.

In general, if you see the payload on the page it is a sign that the filtering is working as it should. If you see it unencoded in the source, it is a sign that you have found an XSS vulnerability. In any case, you are correct that the site in question needs better email validation.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .