Say I have the a website with the following code on it:

<input type="text" id="search-text" name="query" value="?" />


Double quotes aren't escaped so I can break out of the value attribute, however, I can't break out of the HTML tag itself as '<' and > are being filtered out.

My goal here is to get a javascript popup to appear.


There's the onfocus attribute so I guess if someone clicked on the text input box a javascript popup could appear.
However is there a way to make a javascript popup appear when the page first loads?


Try this:

" onfocus="alert(1)" autofocus="


It will expand to:

<input type="text" id="search-text" name="query" value="" onfocus="alert(1)" autofocus="" />


Which will cause an alert box, demonstrating XSS.
