I was reading about XSS Contexts on Portswigger and it has a section about the use of HTML-Encoding in bypassing input validation. What i understand is :
The article showed it in context of an Attribute Injection, but does it work in non-attribute contexts as well.
Also, The payload shown there was
'-alert(1)-'. It dont understand what
- is doing in this payload!
The context was
<input href="#" onclick=" ... var input='user controlled data';" />