Is it possible to inject XSS in a JavaScript variable if a website inserts HTML encoded, user input in a double quoted string?

var userString = "perfectly "safe" input from user?";

  • 2
    Depends on what you're going to do with the string.
    – Rob W
    Jun 26, 2013 at 21:41
  • If nothing done with it and in script tag?
    – user27675
    Jun 26, 2013 at 22:19

1 Answer 1


It is probably not possible to get XSS given this simple character restriction. However, an attacker could inject an escape character, for example:

var userString = "perfectly "safe" input from user?\"+"+alert(1);

In this case the attacker would be injecting a \ and an alert(1) in two different variables which existing in two locations within the <script> tag. Escape characters are a type of control character that are commonly forgotten by developers when sanitizing attacker controlled data.

... also hopefully you took this into consideration:

var userString = "</script><script>alert(1)//"
  • 2
    In the second example, if " is encoded into &quot;, I hope < and > are too!
    – Ry-
    Jun 26, 2013 at 23:02
  • @minitech the op failed to mention such a critical detail!
    – rook
    Jun 27, 2013 at 2:48
  • 1
    HTML encoding includes &lt; &amp; &gt;, but good to know for completeness.
    – user27675
    Jun 27, 2013 at 2:59
  • 1
    @user27675 Yes, any character can be HTML encoded, as the HEX format &#xhhhh; supports all of ASCII and even Unicode! However, you did not mention what HTML encode function you used.
    – rook
    Jun 27, 2013 at 3:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.