Lab: Reflected XSS into a Java Script string with single quote and backslash escaped

Summary: This PortSwigger lab contains a reflected cross-site scripting vulnerability in the search query tracking functionality, where the reflection occurs inside a JavaScript string with single quotes and backslashes escaped. Solving the lab requires a cross-site scripting attack that breaks out of the JavaScript string and calls the alert function, using a payload that breaks out of the script block and injects a new script.
What's compelling: Escaping single quotes and backslashes is a common defense, and this lab shows it can still be broken out of to inject a new script - so a search query reflected into a JavaScript string is a live injection point, not a cosmetic one.

Read the original at PortSwigger Research ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026