Proof of Concept: XSS with innerHTML

A quick demo for a Quora question on XSS: http://tinyurl.com/3g8axm6

by BinaryAcid

HTML

<html>
<head>
</head>
<body>
    <a href="#" id="a">Some DOM node</a>
    <p>Type Javascript in the box and click outside.</p>
</body>
</html>

CSS

body {
    font-family:arial;
    font-size:14px;
    padding:10px;
}

p {
    margin-top:1.15em;
}

input[type=text] {
    margin-left:5px;
}

JavaScript

document.getElementById('a').innerHTML += '<input type="text" onBlur="eval(this.value);" />';