Test XSS filter

Test input for common cross-site scripting payloads and context-sensitive sinks.

freeworks offlinenothing uploaded

ToolXSS Filter Tester

Input

Output

—

Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

AccentBackground

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

How it works

Input is checked for executable tags, event attributes, javascript URLs, and encoded equivalents; findings identify contexts where naive insertion could execute. The tester is heuristic and does not model every browser or sanitizer.

Output encoding must match the insertion context.
Pattern checks are test cases, not proof of safety.

Worked example

Test image onerror XSS payload

Check an img tag with onerror event handler for XSS attack patterns

Input

											<img src=x onerror=alert('XSS')>

Output

												Detected 3 potential XSS threat(s)!

Threats found:
  Pattern: Event handler (high)
  Match: "onerror="
  Risk: Event handler attribute (onclick, onerror, etc.)

  Pattern: img onerror (high)
  Match: "<img src=x onerror"
  Risk: Image error event handler

  Pattern: alert/prompt/confirm (low)
  Match: "alert("
  Risk: Dialog function call

Sanitized output:
&lt;img src=x alert(&#39;XSS&#39;)&gt;

When to use this

Form tests, template reviews, and sanitizer regression suites test XSS cases.

Edge cases

An encoded payload can execute after one decode.
Text-safe input can be dangerous inside a JavaScript string or URL.
CSP reduces impact but does not fix unsafe insertion.

References

OWASP XSS