1

After user submit a html form, on post back when browser renders a page, if one of the input field value is script tag with function surrounded by quote, will the browser ever execute the script and is it considered as XSS attack? For Example:

  <form>    
      <input type="hidden" id="Id" name="Id" value="<script>alert('test');</script>">    
   </form>

My quick test doesn't seems to execute the script. (Why?)
DAST scanner is reporting this as XSS issue

My related issue

LP13
  • 30,567
  • 53
  • 217
  • 400
  • Does this answer your question? [What makes an input vulnerable to XSS?](https://stackoverflow.com/questions/2905886/what-makes-an-input-vulnerable-to-xss) – AndrewL64 Jul 15 '22 at 20:51

0 Answers0