the-web-application-hackers-handbook

Chapter 12 n Attacking Users: Cross-Site Scripting 461
According to specifications, tags should appear within the
section of the HTML page. However, some browsers, including Firefox, accept
tags appearing anywhere in the page, considerably widening the scope
of this attack.
Space Following the Tag Name
Several characters can replace the space between the tag name and the first
attribute name:
Note that even where an attack does not require any tag attributes, you should
always try adding some superfluous content after the tag name, because this
bypasses some simple filters:
alert(1)
Attribute Names
Within the attribute name, you can use the same NULL byte trick described
earlier. This bypasses many simple filters that try to block event handlers by
blocking attribute names starting with on:
Attribute Delimiters
In the original example, attribute values were not delimited, requiring some
whitespace after the attribute value to indicate that it has ended before another
attribute can be introduced. Attributes can optionally be delimited with double
or single quotes or, on IE, with backticks:
Switching around the attributes in the preceding example provides a further
way to bypass some filters that check for attribute names starting with on. If
the filter is unaware that backticks work as attribute delimiters, it treats the
following example as containing a single attribute, whose name is not that of
an event handler: