When doing a XSS, we usually put the JavaScript code between the <script> tags.

I have noticed that HTML injections are very similar because you are doing almost the same thing, but using different tags (e.g <h1>, <p>, <span>, etc.)

The result might very different. When doing a XSS attack, you might create the usual popup with alert(), while doing a HTML injection you might put some fancy text onto the webpage.

  • if you can do one, you can do either, therefore a distinction is not terribly useful. – dandavis Mar 26 '19 at 17:11

In general most of the other answers deal with the question correctly but I didn't notice a few important details being omitted from results.

  1. XSS is so ply the ability to execute attacker-controllee JavaScript in the user's browser. This is not limited to HTML injection as you might have guessed. XSS could be considered the lethal subset of HTML injection.

  2. HTML injection would be a simply the ability to inject attack-controlled HTML. Usually refers to instances where all forms of JavaScript appear to be successfully blocked by the application. This is not very serious, worst case scenario I can see if someone injecting a CSS keylogger.

Some users above mentioned that you prevent XSS by encoding the characters (using htmlspecialchars or another similar, alternative function). Whilst this advice is good, it's not true. You should also never inject user input inside a range of element attributes. For example I could use javascript:alert(0) payload to injection inside a link href, iFrame src and a range of other potential locations.


HTML injection and XSS injection are not the same. As the name suggest in one you inject HTML tags and the other you try to inject and execute javascript somehow. If you are able to inject HTML you can deface a website but if you inject javascript you could do pretty much anything a real user can do. HTML injection can be avoided by HTML encoding user data while XSS in general can be tricky, and where the user data appears should be taken into account. There is quite a bit of difference between both. But yeah both of them happen due to injection theory and improper validation of user input and putting it directly into the DOM or website.

  • when can you inject html but not JS? I can see it going the other way, like an poorly-sanitized attrib leak, but if whole tags are able to be inserted, when does that preclude <script> tags? – dandavis Mar 26 '19 at 17:07
  • One case could be "whitelisting" in which only a few tags are allowed. – Vipul Nair Mar 26 '19 at 17:53

Yes, and No. They are both 'injection' attacks.

  • XSS is about injecting a script into the DOM that a users browser will execute (e.g. Javascript).
  • HTML injection is about injecting HTML into the DOM.

As you pointed out <script></script> is a HTML tag, if you are able to inject this, you should also able to inject javascript.

How you protect against them, is somewhat a little different please see the OWASP CHEAT SHEET For a more comprehensive guide.

  • For XSS: while you should have good input validation (which could protect against all sorts of injection attacks (sql, xss, html, etc.)). The correct way to deal with XSS is with output encoding, rather than relying on input validation.
  • For HTML injection: Use input validation (as output encoding would break your current HTML), and escape un-trusted data before inserting it into the DOM.

It depends on how you define it but both input validation and output encoding issues.I have no problems with people defining XSS as a kind of HTML injection attack. Then XSS can be further subcategorised as persistent and non persistent(which will further branch out as traditional vs DOM based XSS).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.