I have the following code,

<li data-type="test" title="?"> test </li>

Following values were Not allowed


My goal here is to get a javascript popup to appear. is there a way to make an alert popup?


 <li data-type="test" title="" onmouseover="alert(1)//" ""> test </li>
  • 1
    It is working for me. What issue are you having? Commented Sep 12, 2019 at 17:46
  • I need to inject some vector and execute XSS. so I tried the following the vector '"onmouseover="alert(1)//" " '. But they never allowed single/double-quotes. Due to this, I can't inject my vector in the title attribute. so that I need an alternate vector to break down the HTML Attributes and execute the alert using an event(onload, onmouseover,etc.. )
    – saranraj S
    Commented Sep 13, 2019 at 1:12
  • Is this an exercise of some kind, where the expectation is that there is an attack vector, and it's your job to find something more subtle than directly dropping "onmouseover="alert(1)//" in? Or is it an essentially random site that might be fully-hardened against such attacks?
    – TripeHound
    Commented Sep 13, 2019 at 8:57
  • I am starting learning XSS from last week. Most of the places every one using " to break down the HTML Attribute. But i checking the alternate way to break it down. I am also trying to find an alternative solution. But I am a newbie for this field. so that I asked for an help for others.
    – saranraj S
    Commented Sep 14, 2019 at 9:46

1 Answer 1


The situation you describe appears to be not vulnerable to XSS attacks, as there cannot be broken out of the atrribute.

Rejecting the use of special characters, or rather the allowlisting of characters that may be used, is a proper way of handling user input in this case.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .