Escape inline double quote

1

Characters that can break out of an inline value with double quotes

Created on: Friday, March 7, 2025 at 10:27:49 AM

Updated on: Monday, April 28, 2025 at 7:27:33 AM

Vector type: XSS

Vector charset: UTF-8

<input  id="test" value="s$[chr]onload="alert(1)" />

let a = document.getElementById("test");
if (typeof a.onload === 'function') {
log(String.fromCharCode($[i]))
  }