I was wondering if appending a double quote at the end of a query is considered a valid XSS filter. Let's say we have a search function and I entered:


If I look at the source of the resulting query I will see the following:

<input name="search" type="text" value=""><script>alert('hi')</script>">

The double quote will be appended automatically at the end of my query.

Assuming that the filter also scrubs out the null char, and HTML comments <!--, would this be an effective XSS filter or is this just wishful thinking?

  • What html tag are you injecting into? – rook Mar 23 '13 at 18:30
  • sorry my code did not show properly, thanks to Lekensteyn for editing :) – Alistair Mar 23 '13 at 18:33
  • the alert box above should execute... did you try this before posting? – rook Mar 23 '13 at 18:37
  • Ok, now I got it to work :) And thank you for the reply as well! – Alistair Mar 23 '13 at 18:45

I can think of no condition in which this would mitigate XSS. If an attacker supplies <script>alert(1)</script> the result will be: <script>alert(1)</script>" which will still execute.

Further more, an attacker can just comment out the double quote in javascript: alert(1)//"

You don't need an html comment to build valid html:

<input name="search" type="text" value=""><script>alert('hi')</script><input name="inject">

You should read the XSS prevention cheat sheet, XSS is extremely common and you shouldn't come up with home-brew solutions to well known problems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.