---
description: >-
  https://portswigger.net/web-security/cross-site-scripting/stored/lab-html-context-nothing-encoded
---

# Stored XSS into HTML context with nothing encoded

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2F0NWKxjs1iAEAuWlsH37T%2F1.png?alt=media&#x26;token=fe776c34-51da-4157-a60d-914dd00cc4e1" alt=""><figcaption></figcaption></figure>

Let's comment the following payload below the post:

```
<script>alert("1");</script>
```

Since this payload is stored on the page in the form of a comment it will be executed for every user that visits the page.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2FnnzRRarWAteKYJsc3QYp%2F2.png?alt=media&#x26;token=698f6dd9-22fe-4e15-adc1-992630e72993" alt=""><figcaption></figcaption></figure>

We have solved the lab.

<figure><img src="https://1586847736-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FtSZ40gLWhBDTzPEgHsVB%2Fuploads%2Ff5ACb92hvxrn7gvaXTNR%2F3.png?alt=media&#x26;token=47eaf318-5ec0-4010-a2d2-644e1e26a5e8" alt=""><figcaption></figcaption></figure>
