---
title: "My XSS attempt doesn't seem to work on a simple HTML page I made - Cybr"
description: "My XSS attempt doesn't seem to work on a simple HTML page I made: a thread from the Cybersecurity forum on Cybr, with 1 reply. Read-only archive."
url: https://cybr.com/forums/topic/my-xss-attempt-doesnt-seem-to-work-on-a-simple-html-page-i-made/
---

Topic

# My XSS attempt doesn't seem to work on a simple HTML page I made

1 reply

**Archived.** These forums are read-only. The conversation continues on [Discord](https://cybr.com/discord/).

1. techblazes

   Jan 15, 2022

   Hello everyone,

   I wrote a small app with HTML and JS to try and replicate the effect, however the script is not being executed.
   There's no input sanitization whatsoever.

   Could somebody have a look at this codepen and let me know what I am doing wrong?

   [https://codepen.io/techblazes/pen/oNeBPNz](https://codepen.io/techblazes/pen/oNeBPNz)

2. Christophe

   Jan 16, 2022

   Hey [@techblazes](https://cybr.com/members/techblazes/) ! Answered in Discord but will also answer here for anyone else wondering.

   Your sample code is vulnerable and does work with certain payloads.

   .innerHTML doesn't allow for scripts to be executed, so it actually prevents XSS payloads that use script tags (like <script>alert(1)</script>)

   It does *not* prevent XSS payloads that make use of onload events, like: <img src=x onerror=alert();>

[< Back to Cybersecurity](https://cybr.com/forums/forum/cybersecurity/)