JAVASCRIPT CONTEXT / STRING BREAKOUT
JS context
A value is placed between JavaScript string quotes. HTML escaping will not save a value that is already inside executable JavaScript.
// live demo
Hello, operator.
The value of name is inserted into a JavaScript string before the browser executes it.
// try this payload
"; alert('js-context'); //
show the answer
Test URL: append ?name=%22%3B%20alert('js-context')%3B%20%2F%2F to this page.
Why it works: the input is concatenated into a JavaScript string. The payload closes that string, adds a statement, and comments out the trailing quote.
Fix: do not concatenate untrusted data into executable JavaScript. Pass data through a safe DOM/API boundary, or use context-aware JavaScript string encoding when there is no alternative.
show the vulnerable line
script.textContent = `const message = "${name}"; ...`;