Is it possible to get XSS in the value field of Input tag when the application filters out double quote?

<input type="hidden" name="something" id="somenthing" value="my_input_goes_here">

input from request goes inside the value field , so i tried to close it with " and give a payload like " accesskey="X" onclick="alert(1)" but " is filtered out.

So any XSS vector possible in this scenario?

  • Have you tried encoding / double encoding it?
    – Jeroen
    Commented Mar 6, 2019 at 6:25
  • @Jeroen-ITNerdbox Yes, both single and double encoding but still it's getting filtered. Commented Mar 6, 2019 at 11:52

2 Answers 2


No, per the HTML specification, only the matching quote (in this case, double quotes), can get you out of the attribute value context.

You might be able to get a " past the filter with some filter evasion tricks, but as long as the browser's HTML parser doesn't see a literal double quote, it won't exit the attribute context for you to inject a payload.

  • agreed. So is there any event handlers or payload that can be given directly inside the attribute value context itself ? . So that i don't have to use double quote Commented Mar 6, 2019 at 11:57
  • No event handlers cannot be specified inside that paramater you will have to break out of the parameter first
    – yeah_well
    Commented Mar 6, 2019 at 12:57

No,Only a double quote will be able to get out of that situation. But sometimes developers don't quote a parameter .Then they can be broken out of with various ways including [space] % * + , - / ; < = > ^ and |.Lookup OWASP xss filter evasion cheat sheet to learn more.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .