Your html sanitizer should escape ' and "... both characters you're using unescaped.
So does this work with a proper sanitizer? Doesn't look like it.
If you have a broken sanitizer, or worse youre inserting it without sanitizing it, you're already vulnerable to XSS... this is just a lot of writing showing an exploit caused by a broken sanitizer.
So does this work with a proper sanitizer? Doesn't look like it.
If you have a broken sanitizer, or worse youre inserting it without sanitizing it, you're already vulnerable to XSS... this is just a lot of writing showing an exploit caused by a broken sanitizer.