Question

how can i run any javascript in double quotes ?
For example:

<input type="text" value="" />

i would like to execute an alert or any other code in the value = “” (double quotes). Like:

<input type="text" value="<script> onmouseover=alert(0);</script>" />

the code show as a string on page. So is there anyway to execute script in double quotes ?

Answer 1

Ah, I see, you probably want to do something like this:

<input type="text" onchange="try{eval(this.value)}catch(e){}" />

That inline script will attempt to execute what’s in its value attribute every time the tag is changed (and you blur out of the element). The try catch block is so that anything that would normally not work won’t get executed. The eval function parses a string and runs it as Javascript code.

You leave yourself open to many forms of attacks when you use eval, so unless this is for purely educational or in house purposes, I would advise you don’t use this.