'>"></script><svg/onload=confirm('xsss-query7')>

## XSS Payload Analysis

The payload you provided

'>"></script><svg/onload=confirm('xsss-query7')>

is a classic polyglot XSS string that mixes HTML entities and tags to bypass filters.
Breaking it down:

• ' → ' (single‑quote) – closes an opening quote in JavaScript or an attribute.
• > → > – closes an HTML tag that may be opened earlier.
• " → " – closes a double‑quote attribute value.
• </script> → </script> – prematurely ends a <script> block, allowing the following markup to be interpreted as HTML.
• <svg/onload=confirm('xsss-query7')> – opens an <svg> element, adds an onload attribute that runs JavaScript (confirm(...)), and then closes the tag.

This construction exploits the HTML parser’s tolerance for malformed markup and the fact that an <svg> element can contain script without being inside a <script> tag security.stackexchange.com.

## Why This Works – Parsing Details

• The parser reads <svg and moves to tag‑open state, then tag‑name state.
• Encountering / puts it in self‑closing state; the parser then expects an attribute name.
• onload is read as the attribute name, = triggers attribute‑value state, and confirm('xsss-query7') is taken as the attribute value.
• The subsequent > switches back to data state, leaving the JavaScript executed security.stackexchange.com.

Because the parser never sees a closing </svg> tag, the entire payload is treated as a single, self‑closing SVG element that executes JavaScript on load.

## Related Contexts & Prior Research

• The technique is documented in multiple XSS “contests” where attackers used SVG to bypass filters thespanner.co.uk.
• In a Reflected XSS Lab that only permits limited SVG, the same payload can trigger an alert owasp10.com.
• The issue with </script> inside a JavaScript string is that it terminates the script block; escaping it with a backslash prevents this stackoverflow.com.

## Visual Overview

• SVG Element Overview
  ![svg element](https://upload.wikimedia.org/wikipedia/commons/6/6f/SVG_logo.svg) [Wikimedia Commons](https://commons.wikimedia.org/wiki/SVG)

• XSS Flow Diagram
  ![xss flow](https://raw.githubusercontent.com/PortSwigger/xxs-labs/main/images/xss-diagram.png) [PortSwigger](https://portswigger.net/web-security/cross-site-scripting)

• Malformed SVG with onload
  ![svg onload payload](https://i.stack.imgur.com/ZgPY4.png) [Security StackExchange](https://security.stackexchange.com/questions/196551/why-the-following-xss-vectors-work-without-closing-bracket)

• OWASP Top 10 Logo
  ![owasp logo](https://owasp.org/static/img/OWASP_top10_logo.png) [OWASP](https://owasp.org/www-project-top-ten/)

These images illustrate how an SVG tag can carry an onload attribute that runs JavaScript, and they reference the same parsing rules described above.

## Mitigation Tips

• Never trust user input; always HTML‑encode or sanitize data before inserting it into markup.
• Use a Content Security Policy (CSP) that disallows inline scripts ('unsafe-inline') and restricts script sources.
• When embedding SVG, avoid inline event handlers; prefer external scripts or data‑URIs that are properly escaped.

By understanding how the parser treats malformed tags and by applying proper input handling, you can stop payloads like the one above from executing arbitrary code.