Why run away and avoid XSS

Question

I'm just wondering if anyone knows about a utility where not escaping from &to &leads to Cross Site Scripting vulnerability? I thought about it, but could not come up with an example.

Thanks in advance Konne

Answer 1

You can try something like this

& # 39; + warning (1) + & # 39;

worked on search.twitter.com until today.

https://twitter.com/#!/kinugawamasato/status/38539726470397952

Answer 2

A lot depends on where the injection is, but a simple example would be

<a href="&#x6a;&#x61;&#x76;&#x61;&#x73;&#x63;&#x72;&#x69;&#x70;&#x74;&#x3a;&#x61;&#x6c;&#x65;&#x72;&#x74;&#x28;&#x31;&#x29;">XSS</a>    

html- javascript: alert (1), XSS. iframe src, document.location =, window.open() , html .

, URL ,

<a onclick='http://www.foo.com?injection=&#39;*alert(1)*&#39;'>XSS</a>

html , onevent javascript.