XSS Contexts & Detection

In XSS, context means where exactly the user's input is placed in the webpage.

This matters because the same input can be safe in one location but dangerous in another.

Common XSS contexts
User input can appear inside:

HTML text: <p>USER_INPUT</p>
HTML attributes: <input value="USER_INPUT">
JavaScript: <script>
let name = 'USER_INPUT';
</script>
URLs: <a href="USER_INPUT">

Each context has different rules for safely handling untrusted data. XSS protection depends on the context where the data is inserted.

You need to know where the data will be used and apply the appropriate context-specific output encoding.

The input appears as normal text between HTML tags: <div>USER_INPUT</div>
If an attacker enters: <script>alert(1)</script> and if application doesn't encode it, the browser may interpret it as HTML.

Protection: HTML-encode special characters such as:

< → <
> → >
& → &
" → "
' → '

The browser then displays the input as text instead of HTML.

Note: HTML context → HTML encoding

This happens when user input is placed inside an HTML attribute: <input value="Bob">
The browser understands Bob as the value of the value attribute.

If attacker-controlled data contains a quotation mark and isn't properly encoded, it may change the structure of the HTML.
The attacker could potentially turn one attribute into multiple attributes or introduce an event-handler attribute.
<input value="..." onmouseover="...">

The important point is that a <script> tag is not required for XSS. HTML event-handler attributes can also cause JavaScript to execute.

Quoted Attribute: <input value="USER_INPUT">
UnQuoted Attribute: <input value=USER_INPUT>

Unquoted attributes have more characters that can terminate or alter the value, making them harder to handle safely.

HTML text: encode HTML special characters.
HTML attribute: use quoted attributes and attribute-safe HTML encoding.

This happens when user input is placed directly inside JavaScript: var name = "USER_INPUT";

HTML encoding doesn't protect it because the browser is parsing the content as JavaScript, not HTML.

The input must be safely encoded for a JavaScript string context, including quotes and special characters. Also, avoid allowing </script> to appear literally inside a <script> block, as it can terminate the block.

This happens when user input is placed inside a URL: <a href="USER_INPUT">

There are two main risks:
Improper URL encoding can change how the URL is interpreted.
A user-controlled URL could use a dangerous scheme such as javascript:.

Protection:
Properly URL-encode user-controlled data.
Allowlist safe schemes such as https:// and http://.
Avoid allowing arbitrary URLs when possible.

URL context → URL encoding + validate the URL scheme.