I'm pentesting a website that has a reflected XSS, or at least a vector for a reflection, but the issue is the following :
- It escapes
"to their HTML entities, but not
- You are not in a tag, so you have to create your own.
It's not the first time that I see implementations of this sort. Express.js has this by default for example. Are implementations like these safe from XSS?