on my website i deliver an xml, whereas GET parameters will be added as (entityencoded) attributes somewhere in the xml.
stripped down example:
<root> <element x="y" /> </root>
note that the string is being html entity encoded so you cant really escape out of the quotes. a string like this
but could this be exploited another way?