user input is reflected inside a variable. For example


is reflected as shown below

var test="hello";

I tried to evade from the variable with payload like hello"; or hello%22; or hello%2522; but unsuccessfully. All these characters are reflected without encoding: .[]{};:{}\/?|_-+ so i can use them

Is there another way to exploit this situation?

1 Answer 1


No, not given the filter behavior you specified.

  • You need double quotes (") to exit the JS string context.

  • You need angle brackets (<>) to exit the <script> tag which I presume surrounds the code.

  • You can use a backslash (\) at the end of the string to escape the closing quote, however you'd need another injection point on the same line to do anything useful with that. Otherwise you're unable to close the string you've now kept open, and the JS parser will throw a syntax error, implying it does not execute any part of the script.

    Here is how an attack would work with two injection points.


    var test="hello"; var test2="stranger";


              \                  ;alert()//


    var test="\"; var test2=";alert()//";
             |--------------|        |--|
           one continuous string    comment

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .