[{"data":1,"prerenderedAt":348},["ShallowReactive",2],{"guide-html-entity-injection-testing":3},{"id":4,"title":5,"body":6,"date":338,"description":339,"extension":340,"meta":341,"navigation":342,"path":343,"readingTime":344,"seo":345,"stem":346,"__hash__":347},"guides\u002Fguides\u002Fhtml-entity-injection-testing.md","HTML Entity Injection and Testing",{"type":7,"value":8,"toc":332},"minimark",[9,13,18,34,40,96,99,102,106,109,116,139,145,166,172,216,222,250,261,265,268,302,305,309,316,319,328],[10,11,12],"p",{},"Security testing for web applications involves probing input fields and output rendering for vulnerabilities. One technique that proves especially useful is HTML entity injection testing—crafting payloads that leverage entity encoding to bypass sanitization filters and expose cross-site scripting (XSS) flaws. Understanding how entity injection works helps developers build more robust defenses and helps testers find vulnerabilities before attackers do.",[14,15,17],"h2",{"id":16},"why-entity-encoding-matters-in-security-testing","Why Entity Encoding Matters in Security Testing",[10,19,20,21,25,26,29,30,33],{},"Sanitization filters often look for dangerous strings like ",[22,23,24],"code",{},"\u003Cscript>",", ",[22,27,28],{},"javascript:",", or ",[22,31,32],{},"onerror="," in their literal form. However, HTML entities provide an alternate representation of these same characters. If a filter checks for malicious patterns before the browser decodes entities, an attacker can slip encoded payloads past the filter while the browser still executes them.",[10,35,36,37,39],{},"For example, a filter that blocks ",[22,38,24],{}," might not catch:",[41,42,47],"pre",{"className":43,"code":44,"language":45,"meta":46,"style":46},"language-html shiki shiki-themes github-light github-dark","<script>alert(1)<\u002Fscript>\n<script>alert(1)<\u002Fscript>\n","html","",[22,48,49,76],{"__ignoreMap":46},[50,51,54,58,62,65,68,70,73],"span",{"class":52,"line":53},"line",1,[50,55,57],{"class":56},"sj4cs","<",[50,59,61],{"class":60},"sVt8B","script",[50,63,64],{"class":56},">",[50,66,67],{"class":60},"alert(1)",[50,69,57],{"class":56},[50,71,72],{"class":60},"\u002Fscript",[50,74,75],{"class":56},">\n",[50,77,79,82,84,87,89,91,93],{"class":52,"line":78},2,[50,80,81],{"class":56},"<",[50,83,61],{"class":60},[50,85,86],{"class":56},">",[50,88,67],{"class":60},[50,90,81],{"class":56},[50,92,72],{"class":60},[50,94,95],{"class":56},">\n",[10,97,98],{},"Whether these payloads execute depends on the decoding order and the output context. If the application re-encodes the input before rendering, the entity-encoded script tags will display as text—the intended safe behavior. If the application outputs the encoded input inside an element that performs its own decoding, the script may execute.",[10,100,101],{},"The fundamental question entity injection testing answers: does the application decode user input and then re-encode it, or does it pass encoded content through to contexts where the browser decodes it unsafely?",[14,103,105],{"id":104},"common-entity-injection-test-payloads","Common Entity Injection Test Payloads",[10,107,108],{},"Security testers use a taxonomy of payloads that target different decoding contexts. Each payload tests whether the application handles entity-encoded characters correctly in that context.",[10,110,111,115],{},[112,113,114],"strong",{},"HTML body context payloads."," Test whether entity-encoded angle brackets are rendered as text or interpreted as markup:",[41,117,119],{"className":43,"code":118,"language":45,"meta":46,"style":46},"<img src=x onerror=alert(1)>\n<svg onload=alert(1)>\n",[22,120,121,130],{"__ignoreMap":46},[50,122,123,125,128],{"class":52,"line":53},[50,124,57],{"class":56},[50,126,127],{"class":60},"img src=x onerror=alert(1)",[50,129,75],{"class":56},[50,131,132,134,137],{"class":52,"line":78},[50,133,81],{"class":56},[50,135,136],{"class":60},"svg onload=alert(1)",[50,138,95],{"class":56},[10,140,141,144],{},[112,142,143],{},"Attribute context payloads."," Test whether entity-encoded quotes can break out of attribute values:",[41,146,148],{"className":43,"code":147,"language":45,"meta":46,"style":46},"\" onclick=alert(1) \"\n" onclick=alert(1) "\n",[22,149,150,155],{"__ignoreMap":46},[50,151,152],{"class":52,"line":53},[50,153,154],{"class":60},"\" onclick=alert(1) \"\n",[50,156,157,160,163],{"class":52,"line":78},[50,158,159],{"class":56},""",[50,161,162],{"class":60}," onclick=alert(1) ",[50,164,165],{"class":56},""\n",[10,167,168,171],{},[112,169,170],{},"JavaScript context payloads."," Test whether Unicode escape sequences or hex entities execute within script blocks:",[41,173,175],{"className":43,"code":174,"language":45,"meta":46,"style":46},"\u003Cscript>var x = '\\u003c\\u0069\\u006d\\u0067\\u0020\\u0073\\u0072\\u0063\\u003d\\u0078\\u0020\\u006f\\u006e\\u0065\\u0072\\u0072\\u006f\\u0072\\u003d\\u0061\\u006c\\u0065\\u0072\\u0074\\u0028\\u0031\\u0029\\u003e';\u003C\u002Fscript>\n",[22,176,177],{"__ignoreMap":46},[50,178,179,182,185,188,192,195,198,202,205,208,211,213],{"class":52,"line":53},[50,180,181],{"class":60},"\u003C",[50,183,61],{"class":184},"s9eBZ",[50,186,187],{"class":60},">",[50,189,191],{"class":190},"szBVR","var",[50,193,194],{"class":60}," x ",[50,196,197],{"class":190},"=",[50,199,201],{"class":200},"sZZnC"," '",[50,203,204],{"class":56},"\\u003c\\u0069\\u006d\\u0067\\u0020\\u0073\\u0072\\u0063\\u003d\\u0078\\u0020\\u006f\\u006e\\u0065\\u0072\\u0072\\u006f\\u0072\\u003d\\u0061\\u006c\\u0065\\u0072\\u0074\\u0028\\u0031\\u0029\\u003e",[50,206,207],{"class":200},"'",[50,209,210],{"class":60},";\u003C\u002F",[50,212,61],{"class":184},[50,214,215],{"class":60},">\n",[10,217,218,221],{},[112,219,220],{},"Nested encoding payloads."," Test whether the application decodes multiple times, a vulnerability known as double-decoding:",[41,223,225],{"className":43,"code":224,"language":45,"meta":46,"style":46},"<script>alert(1)<\u002Fscript>\n",[22,226,227],{"__ignoreMap":46},[50,228,229,232,235,237,240,242,245,247],{"class":52,"line":53},[50,230,231],{"class":56},"&",[50,233,234],{"class":60},"lt;script",[50,236,231],{"class":56},[50,238,239],{"class":60},"gt;alert(1)",[50,241,231],{"class":56},[50,243,244],{"class":60},"lt;\u002Fscript",[50,246,231],{"class":56},[50,248,249],{"class":60},"gt;\n",[10,251,252,253,256,257,260],{},"If the application decodes once, the output becomes ",[22,254,255],{},"<script>alert(1)<\u002Fscript>","—safe entity-encoded text. If it decodes twice, the output becomes ",[22,258,259],{},"\u003Cscript>alert(1)\u003C\u002Fscript>","—executable markup.",[14,262,264],{"id":263},"testing-workflow","Testing Workflow",[10,266,267],{},"A systematic approach to entity injection testing follows these steps:",[269,270,271,278,284,290,296],"ol",{},[272,273,274,277],"li",{},[112,275,276],{},"Identify input vectors."," Find all points where user-supplied data enters the application—form fields, URL parameters, HTTP headers, and API endpoints.",[272,279,280,283],{},[112,281,282],{},"Determine output context."," Trace where the input appears in the response—HTML body, attributes, JavaScript, CSS, or URLs. Each context requires different encoding behavior.",[272,285,286,289],{},[112,287,288],{},"Send entity-encoded payloads."," Submit input containing entity-encoded dangerous characters relevant to that context.",[272,291,292,295],{},[112,293,294],{},"Analyze the response."," Check the raw HTML source, not the rendered page. Determine whether the application re-encodes the entities or passes them through.",[272,297,298,301],{},[112,299,300],{},"Verify execution."," If the encoded payload appears intact in the output source, test whether the browser decodes and executes it in that context.",[10,303,304],{},"This workflow reveals whether the application applies context-aware encoding or relies on input-side filtering that entities can bypass.",[14,306,308],{"id":307},"defensive-implications","Defensive Implications",[10,310,311,312,315],{},"The key takeaway for developers: output encoding must happen at the point of rendering, not at the point of input. Input validation reduces the attack surface but cannot replace context-aware output encoding. Frameworks like Vue, React, and Angular handle this automatically for their template contexts. For server-rendered HTML, use templating engines with built-in auto-encoding, such as Go's ",[22,313,314],{},"html\u002Ftemplate"," or Jinja2's autoescaping.",[10,317,318],{},"Additionally, Content Security Policy (CSP) headers provide a fallback defense. Even if an entity-encoded payload reaches an executable context, a strict CSP that disallows inline scripts will block execution.",[10,320,321,322,327],{},"For quick encoding of test payloads or verifying entity output, the ",[323,324,326],"a",{"href":325},"\u002Ftools\u002Fhtml-entity","HTML Entity tool"," converts characters to their named and numeric-entity equivalents.",[329,330,331],"style",{},"html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s9eBZ, html code.shiki .s9eBZ{--shiki-default:#22863A;--shiki-dark:#85E89D}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}",{"title":46,"searchDepth":78,"depth":78,"links":333},[334,335,336,337],{"id":16,"depth":78,"text":17},{"id":104,"depth":78,"text":105},{"id":263,"depth":78,"text":264},{"id":307,"depth":78,"text":308},"2026-05-28","How security testers use entity encoding to probe for XSS and injection vulnerabilities.","md",{},true,"\u002Fguides\u002Fhtml-entity-injection-testing",6,{"title":5,"description":339},"guides\u002Fhtml-entity-injection-testing","LwDvyx5xvJ-Z6sca-ePUzVvZA-PKdfW2UBFmKzkeOJo",1780401334389]