Is appending a double quote at the end of an input query a valid XSS prevention method?

Question

I was wondering if appending a double quote at the end of a query is considered a valid XSS filter. Let's say we have a search function and I entered:

"><script>alert('hi')</script>

If I look at the source of the resulting query I will see the following:

<input name="search" type="text" value=""><script>alert('hi')</script>">

The double quote will be appended automatically at the end of my query.

Assuming that the filter also scrubs out the null char, and HTML comments <!--, would this be an effective XSS filter or is this just wishful thinking?

Answer 1

I can think of no condition in which this would mitigate XSS. If an attacker supplies <script>alert(1)</script> the result will be: <script>alert(1)</script>" which will still execute.

Further more, an attacker can just comment out the double quote in javascript: alert(1)//"

You don't need an html comment to build valid html:

<input name="search" type="text" value=""><script>alert('hi')</script><input name="inject">

You should read the XSS prevention cheat sheet, XSS is extremely common and you shouldn't come up with home-brew solutions to well known problems.