> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/portswigger-web-academy/xss/xss-contexts/lab-4.md).

# Lab 4

```
'-alert(document.domain)-'
';alert(document.domain)//
```

Here, the ' escapes the string. The "-" is the subtract symbol which connects to the alert. The ";" is a end statement syntax. The "//" is the comment operator. 

### Backslash

Your input `test'payload` lands inside a JS string:

```javascript
var searchTerm = 'test'payload';
```

**Problem for the server:** the `'` in your input would prematurely end the JS string, breaking their code. So the server "protects itself" by adding a `\` before your quote:

```javascript
var searchTerm = 'test\'payload';
```

{% hint style="info" %}
Backslash is the **escape character** in most string contexts (JS strings, JSON, regex, shell, etc.). When a character needs to be neutralized so it doesn't break syntax, the parser looks for `\<character>`.

To defend properly:

* Escape `'` → `\'`
* Escape `\` → `\\`
  {% endhint %}

**Server's naive escaping** (escapes `'` but not `\`):

```
Your input:    \    '    ;alert(1)//
Server output: \    \'   ;alert(1)//    ← added \ before your '
Combined:      \\';alert(1)//
```

**How JS parses `'\\';alert(1)//'`:**

* `'` → start string
* `\\` → escape sequence meaning "literal backslash"
* `'` → **end string** (unescaped! the `\\` ate the escape)
* `;alert(1)` → runs
* `//` → comment

<figure><img src="/files/TBm0tAMVMIL9d7z7Y1wp" alt=""><figcaption></figcaption></figure>

If we go to postID and create a AND statement:

<https://0a1d002d040b73d580e01cb300a700b3.web-security-academy.net/post?postId=2&test>

We can enter the \&test without any problems. - And I was stumped after this. So I'll need to analyze the payload answer. <br>

<figure><img src="/files/QfGpqVdyVUQZppflDWjb" alt=""><figcaption></figcaption></figure>

### What are HTML Entities?

Some characters are reserved in HTML.

If you use the less than (<) or greater than (>) signs in your HTML text, the browser might mix them with tags.

Entity names or entity numbers can be used to display reserved HTML characters.

Entity names look like this:

&*entity\_name*;

Entity numbers look like this:

\&#*entity\_number*;

<figure><img src="/files/f8mleD28fVqQtyggxJt3" alt=""><figcaption></figcaption></figure>

Hence, something like "<http://foo?&apos;-alert(1)-&apos;>" would work, because this translates itno

<figure><img src="/files/adpH3QYokh6cCV0stsEh" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/TDlTXb66GkPzepaiPFcO" alt=""><figcaption></figcaption></figure>

`${alert(1)}`&#x20;

This is a simple alert javascript -  `${...}` is JavaScript template literal syntax — inside backtick strings, anything in `${}` gets evaluated as JavaScript:

```js
const x = `${alert(1)}`; // alert(1) runs immediately when this line executes

let a = 5, b = 10;
console.log(`${a} + ${b} = ${a + b}`); // "5 + 10 = 15"
```

{% hint style="info" %}
In JavaScript, backticks are used to create **template literals**, which are a special type of string introduced in ES6 (2015). They're different from regular single quotes `'...'` or double quotes `"..."`.\
\
The big feature: anything inside `${...}` gets evaluated as actual JavaScript and the result gets inserted into the string. This is called **string interpolation** — way cleaner than concatenating with `+`.
{% endhint %}