Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped

PortSwigger Web Security Academy lab: Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped.

Stored XSS into onclick event with angle brackets and double quotes HTML-encoded and single quotes and backslash escaped

$ tldr PortSwigger · Cross-Site Scripting (XSS)

·	·
Platform	PortSwigger Web Security Academy
Topic	Cross-Site Scripting (XSS)
Difficulty	PRACTITIONER
Official lab	Open

Solve the lab

Language	Author	Format	Link
🇬🇧 EN	PortSwigger	Texto	Open
🇬🇧 EN	z3nsh3ll	Vídeo	Open

Resources by skill

Skill	Source	Link
Cross-Site Scripting (XSS)	HackTricks	Open
Cross-Site Scripting (XSS)	PortSwigger	Open

Related skills

Cross-Site Scripting (XSS)

---

Comments & tips

Solved this lab a different way? Share it here — comments live in GitHub Discussions.

Last updated: 2026-05-08