Let's say a website contains the following <script> tag and does not have a CSP blocking any execution here.

<script type="text/javascript">

At first glance, this code looks like it's vulnerable to XSS by adding a hash or query parameter containing a XSS payload to the URL. For instance https://example.com/document.html?<script>alert()</script>. Since < and > are URL encoded however, this does not work and does not result in reflective XSS.

Is the given code safe to user or are there ways (perhaps by encoding the payload or by abusing browser behavior) to achieve XSS here?

1 Answer 1


Internet Explorer and possibly other old browsers might be vulnerable to this attack. In modern browsers, the URL-encoding of special characters within location.href effectively acts as HTML-escaping, so it's not possible to inject the characters needed to create a new script element or add a scripting-related attribute to an element. The only way to perform an XSS attack would be if the website inserts location.href into an existing script context.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .