Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
When doing a XSS, we usually put the JavaScript code between the <script> tags.
I have noticed that HTML injections are very similar because you are doing almost the same thing, but using different tags (e.g <h1>, <p>, <span>, etc.)
The result might very different. When doing a XSS attack, you might create the usual popup with alert(), while doing a HTML injection you might put some fancy text onto the webpage.
In general most of the other answers deal with the question correctly but I didn't notice a few important details being omitted from results.
XSS is so ply the ability to execute attacker-controllee JavaScript in the user's browser. This is not limited to HTML injection as you might have guessed. XSS could be considered the lethal subset of HTML injection.
HTML injection would be a simply the ability to inject attack-controlled HTML. Usually refers to instances where all forms of JavaScript appear to be successfully blocked by the application. This is not very serious, worst case scenario I can see if someone injecting a CSS keylogger.
Some users above mentioned that you prevent XSS by encoding the characters (using htmlspecialchars or another similar, alternative function). Whilst this advice is good, it's not true. You should also never inject user input inside a range of element attributes. For example I could use javascript:alert(0) payload to injection inside a link href, iFrame src and a range of other potential locations.
XSS is the ability to execute javascript code (i.e. alert(1)). HTML injection is the ability to execute HTML (such as <p>, like you said).
Often they go hand in hand.
When <script> tags are deleted by a filter of the web app, attackers can often still achieve to execute javascript (XSS) by leveraging HTML injection through:
<img src='x' onerror=alert(1);>
HTML injection and XSS injection are not the same. As the name suggest in one you inject HTML tags and the other you try to inject and execute javascript somehow. If you are able to inject HTML you can deface a website but if you inject javascript you could do pretty much anything a real user can do. HTML injection can be avoided by HTML encoding user data while XSS in general can be tricky, and where the user data appears should be taken into account. There is quite a bit of difference between both. But yeah both of them happen due to injection theory and improper validation of user input and putting it directly into the DOM or website.
<script> tags?
It depends on how you define it but both input validation and output encoding issues.I have no problems with people defining XSS as a kind of HTML injection attack. Then XSS can be further subcategorised as persistent and non persistent(which will further branch out as traditional vs DOM based XSS).
