I was reading about XSS Contexts on Portswigger and it has a section about the use of HTML-Encoding in bypassing input validation. What i understand is :
- The browser html decodes the entities before passing them to the javascript engine.
The article showed it in context of an Attribute Injection, but does it work in non-attribute contexts as well.
Also, The payload shown there was '-alert(1)-'. It dont understand what - is doing in this payload!
The context was <input href="#" onclick=" ... var input='user controlled data';" />
