I am pentesting a website and I found that I can inject code at value=""

<input type="text" id="search_1" name="keyword" placeholder="Search by keyword" value="XSS?" class="search-input input-group-field with-floating-label" data-module="autocomplete" required>`

I can enter all characters except double quotes (") because it encodes them for me.

So, my questions is, can I exploit XSS without leaving the value = " " or is there any way to get out of the value?

  • 2
    What about: <input onmouseover=prompt(1)>? Assuming it is displayed in the HTTP response.
    – Jeroen
    Jun 6, 2021 at 14:21

2 Answers 2


No, if you can't enter double quotes you cannot escape from the attribute value. See the WHATWG spec for details on how browsers parse attribute values. The possible parser state transitions in that state are:

character effect
" double quote end attribute value
& ampersand parse a character reference
NULL error, but will continue parse
EOF error, will end parse
other characters added to attribute value

So unless there is a bug in the HTML parser, you cannot escape. The & ampersand is the only interesting character in this context, but it does not lead to parser states that would terminate the attribute value. A null character will be substituted with the U+FFFD replacement character, so it will not lead to interesting behaviour in the browser.

However, the web application will do something interesting with that input value. Maybe this “something” will have exploitable vulnerabilities if you can provide a specially prepared value.


I've also faced this kind of situation. The developers has sanitized " to prevent XSS vulnerability. You cannot get rid of ".

And inside the double quote is a single string while the attribute is value. So, you cannot exploit it. Because to exploit you have to bring input out of the double quote anyway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.