# XSS Context Patterns
# Common HTML/JavaScript/CSS patterns where XSS payloads can be injected

# HTML Body Context
# Injection reflects directly in HTML body content
<div>USER_INPUT</div>
<span>USER_INPUT</span>
<p>USER_INPUT</p>
<h1>USER_INPUT</h1>

# HTML Attribute Context - Double Quote
# Injection reflects inside double-quoted attribute
<input value="USER_INPUT" type="text">
<div class="USER_INPUT">content</div>
<img alt="USER_INPUT" src="image.jpg">

# HTML Attribute Context - Single Quote
# Injection reflects inside single-quoted attribute
<input value='USER_INPUT' type='text'>
<div class='USER_INPUT'>content</div>

# HTML Attribute Context - No Quotes
# Injection reflects in unquoted attribute
<input value=USER_INPUT type=text>
<div class=USER_INPUT>content</div>

# JavaScript String Context - Single Quote
# Injection reflects inside single-quoted JavaScript string
var name = 'USER_INPUT';
message('USER_INPUT');

# JavaScript String Context - Double Quote
# Injection reflects inside double-quoted JavaScript string
var name = "USER_INPUT";
message("USER_INPUT");

# JavaScript Template Literal
# Injection reflects inside template literal
var name = `USER_INPUT`;
message(`USER_INPUT`);

# CSS Context
# Injection reflects inside CSS
<style>
.user-class {
    color: USER_INPUT;
}
</style>

# URL Context
# Injection reflects in URL
<a href="USER_INPUT">link</a>
<iframe src="USER_INPUT"></iframe>

# Source Context
# Injection reflects in src attribute
<script src="USER_INPUT"></script>
<iframe src="USER_INPUT"></iframe>
<img src="USER_INPUT">

# Meta Tag Context
<meta http-equiv="X-USER_INPUT" content="value">
<meta name="USER_INPUT" content="value">

# Event Handler Context
<img onload="USER_INPUT">
<body onerror="USER_INPUT">
<input onfocus="USER_INPUT">

# Data Attribute Context
<div data-value="USER_INPUT">
<button data-action="USER_INPUT">

# Title/Attribute Context
<title>USER_INPUT</title>
<meta name="description" content="USER_INPUT">

# Comment Context
<!-- USER_INPUT -->
<!--
    USER_INPUT
-->

# Script Tag Context (but not inside quotes)
<script>
    var x = USER_INPUT;
</script>
