I'm working on a website and I noticed that if I go to the following URL: website.com/page?alert() this message is reflected in the action form. I tried to close the action attribute using double quotes in order to try a classic like " onload="alert(1)" but double quotes are URLencoded if i read the source code. Do you have some suggestion? Or is just a rabbit hole? Thanks

 <form method="post" action="./page?alert()" id="cn">
<div class="n">
  • 2
    In general this is safe. For an action attribute the only thing you could do (that I can think of)is try to close the double quote and inject new attributes/HTML, but if you tried that and it didn't work (because it is properly escaping double quotes), then that's really all there is to it. Aug 6, 2020 at 9:44
  • 2
    Most likely what's going on is that the website is reflecting the URL back to the action in the form tag. This is pretty common behavior in old-school applications. There are definitely better ways to do things, but that obviously doesn't matter here. Aug 6, 2020 at 9:44

1 Answer 1


While the reflection of user input this way seems like an unnecessary risk taken by the application, the situation you describe cannot be directly abused.

You would indeed need to be able to break out of the attribute. Another method would be to inject a JavaScript URI at the start of the action attribute, like javascript:alert(1) which would execute on form submission. But in the context of this application I do not think this is possible either.

  • I expect (most, at least) modern browsers won't let you submit a form to a javascript: URI anyhow. You can't use that in several other scenarios where it would be useful, like a child iframe navigating the parent page or turning a 3xx-based open redirect into XSS... though the latter one did work in IE.
    – CBHacking
    May 2, 2023 at 10:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .