consider a website that handles search query like this:
<input class="something" type="search-field" value="SEARCHQUERY">
if i try to inject this script it doesnt work...
This is probably because the website encodes double quote as
". I even tried double encoding by encoding double quote as
%2522, but the webisite seems to render this as
"%22 onerror%22alert(0)" and for some reason, the
%22 is not further decoded
Is there a way to bypass this?