consider a website that handles search query like this:

<input class="something" type="search-field" value="SEARCHQUERY">

if i try to inject this script it doesnt work...

" onerror="alert(0)

This is probably because the website encodes double quote as &quot. I even tried double encoding by encoding double quote as %2522, but the webisite seems to render this as "%22 onerror%22alert(0)" and for some reason, the %22 is not further decoded

Is there a way to bypass this?

  • did you try using single quotes? – CD Rohling Jun 12 at 13:35
  • yeah, doesnt work – dopa_craver Jun 13 at 10:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.