BSCP

Practice session

A reflected XSS payload is injected via a URL query parameter and immediately rendered into an HTML attribute without encoding. Which of the following payloads would most reliably break out of the attribute context and execute JavaScript?

Loading your practice session…