It depends on context. Which are of basic 5 types:
- HTML context
In the body of an existing HTML tag or at the start and end of the page outside of the tag.
<some_html_tag> user_input </some_html_tag>
In this context you can enter any kind of valid HTML in the user input and it would immediately be rendered by the browser, its an executable context.
<img src=x onerror=alert(1)>
- Attribute Name Context
Inside the opening HTML tag, after tag name or after an attribute value.
<some_html_tag user_input some_attribute_name="some_attribute_value"/>
- Attribute Value Context
Inside the opening HTML tag, after an attribute name separated by an = symbol.
<some_html_tag some_attribute_name="user_input" />
<some_html_tag some_attribute_name='user_input' />
<some_html_tag some_attribute_name=user_input />
There are three variations of this context:
- Double quoted attribute
- Single quoted attribute
- Quote less attribute
Code execution in this context would depend on the type of attribute in which the input appears. There are different types of attributes:
a) Event attributes
b) URL attributes
c) Special URL attributes
These are URL attributes where entering a regular URL can lead to security issues.
Some examples are:
Entering just an absolute http or https URL in these cases could affect the security of the website. In some cases if it is possible to upload user controlled data on to the server then even entering relative URLs here would lead to a problem. Some sites might strip off http:// and https:// from the values entered in these attributes to prevent absolute URLs from being entered but there are many ways in which an absolute URL can be specified.
d) META tag attributes
Meta tags like Charset can be influence how the contents of the page are interpreted by the browser. And then there is the http-equiv attribute, it can emulating the behaviour of HTTP response headers. Influencing the values of headers like Content-Type, Set-Cookie etc will have impact on the security of the page.
e) Normal attributes
If the input appears in a normal attribute value then this context must be escaped to lead to code execution. If the attribute is quoted then the corresponding quote must be used to escape the context. In case of unquoted attributes space or backslash should do the job. Once out of this context a new event handler can be added to lead to code execution.
- HTML Comments Context
Inside the comments section of HTML
<!-- some_comment user_input some_comment -->
This is a non-executable context and it is required to come out this context to execute code. Entering a --> would terminate this context and switch any subsequent text to HTML context.
--><img src=x onerror=alert(1)>
a) Code context
b) Single quoted string context
c) Double quoted string context
d) Single line comment context
e) Multi-line comment context
f) Strings being assigned to Executable Sinks
If user input is between SCRIPT tags then, no matter in which of the above contexts it appears you can switch to the HTML context simply by including a closing SCRIPT tag and then insert any HTML.
</script><img src=x onerror=alert(1)>
Other miscelleneous are VBScript and CSS contexts which aren't much used. But those could be used by context aware scripts (scanners, both static and dynamic) to detect potential XSS (used in Burp Engine).