XSS JavaScript Double Quoted String with HTML Escaped Possible?

Question

Is it possible to inject XSS in a JavaScript variable if a website inserts HTML encoded, user input in a double quoted string?

var userString = "perfectly "safe" input from user?";

Answer 1

It is probably not possible to get XSS given this simple character restriction. However, an attacker could inject an escape character, for example:

var userString = "perfectly "safe" input from user?\"+"+alert(1);

In this case the attacker would be injecting a \ and an alert(1) in two different variables which existing in two locations within the <script> tag. Escape characters are a type of control character that are commonly forgotten by developers when sanitizing attacker controlled data.

... also hopefully you took this into consideration:

<script>
var userString = "</script><script>alert(1)//"
</script>