If I have...

<table onclick="texttexttexttextUSERINPUTHERE"></table> Would XSS be possible? I mean with > and " filtered out. I know if there wasn't text behind the user input, you could put alert(0), and that would set off when clicked, but I don't know if it's possible with this case.

  • 3
    You’re already in an attribute value that is interpreted as JavaScript. – Gumbo Jul 7 '14 at 7:27
  • @gumbo but can I run my own javascript? The "texttexttext..." is already there, so if I were to put alert(0), it wouldn't work. – Michael Blake Jul 7 '14 at 7:29
  • 1
    Of course you have to choose your injected code so that the resulting attribute value is valid JavaScript. For example, if the injection is inside a JavaScript string literal, you have to leave it before being able to use arbitrary JavaScript. So what exactly is the code before the injection point? – Gumbo Jul 7 '14 at 7:47

It's very possible:


Would give you execution of your code, regardless of what the string literal is. You just make it into a unused function - and you execute everything after that.

Edit: plus - you can often use single quotes as a substitute for double quotes.

  • how would this work.. for example jsfiddle.net/y0bh17jg that works as the onclick=dddd has no quotes around the dddd, and it has round brackets after the dddd. And how would they they add script tags(or what?), in there to do dddd=function(){...} ? – barlop Jul 26 '19 at 22:23
  • what i can see is possible is a programmer has a server written in eg something like rails, and an html template with substitution of variables. And somewhere else in the template it hasa variable named like $username or $comment, and the programmer thinks is a username or comment, but a hacker user got script tags in there and code within it. Still though, A)the hacker doesn't need to wait for 'onclick', they can just let the code run while the page loads, and B)how would onclick="dddd" execute a procedure, wouldn't it have to be onclick=dddd();? – barlop Jul 26 '19 at 22:31
  • and wouldn't it have to be <table onclick=@texttexttexttext></table> If he hasn't got the @ then why would it substitute at all? – barlop Jul 28 '19 at 21:07

Probably want to use a hidden input form field for storing user input instead of putting it inline. You can sanitize it before storing it but in this example its sanitized on demand.

The actual sanitizing of the user input can be done at different times in different languages, so is just abstracted with jazzhands.

    var myNamespace = {};
    myNamespace.sanitize = function (ickyUserInput) {
        var sanitizedUserInput = "*jazzhands*";
        //do real work here
        return sanitizedUserInput;
    myNamespace.tableClick = function (tableClickParameter) {
        var userInput = myNamespace.sanitize($('#userInput1').val());
        //do work without fear of bad users

<table onclick="myNamespace.tableClick('texttexttexttext')">
    <tr><td>Hi mom!</td></tr>

<input id="userInput1" type="hidden" value="=function(){};alert(document.cookie);" />

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.