EXERCISE 2 — Correct encoding of "><img src=x onerror=alert(1)>
===============================================================

THE RAW VALUE:
  "><img src=x onerror=alert(1)>

(a) HTML BODY context  ->  <p>HERE</p>
    Apply HTML ENTITY encoding (encode < > & ; here " also commonly encoded):
      "   stays  "   (or &quot;) -- harmless in body
      >   ->  &gt;
      <   ->  &lt;
    Encoded output:
      &quot;&gt;&lt;img src=x onerror=alert(1)&gt;
    Rendered HTML:
      <p>&quot;&gt;&lt;img src=x onerror=alert(1)&gt;</p>
    WHAT THE BROWSER DISPLAYS (as literal text):
      "><img src=x onerror=alert(1)>
    WHY IT DOESN'T EXECUTE: the < and > are now &lt; / &gt; ENTITIES, so the
    parser does NOT see a start tag. No <img> element is created, so there is
    no onerror to fire. The string is shown as inert text -- data, not markup.

(b) QUOTED HTML ATTRIBUTE context  ->  <input value="HERE">
    Apply ATTRIBUTE encoding (must also encode the quote that delimits the
    value; encode " and < > too):
      "   ->  &quot;
      >   ->  &gt;
      <   ->  &lt;
    Encoded output:
      &quot;&gt;&lt;img src=x onerror=alert(1)&gt;
    Rendered HTML:
      <input value="&quot;&gt;&lt;img src=x onerror=alert(1)&gt;">
    WHAT THE BROWSER DOES: the &quot; is treated as a literal quote CHARACTER
    INSIDE the value, NOT as the delimiter that ends the attribute. So the
    value never closes early; the attacker can't break out of value="..." to
    add a new tag or an onX handler. The whole thing stays the (harmless)
    value of the input.
    WHY IT DOESN'T EXECUTE: the breakout depended on a real " ending the
    attribute followed by > closing the tag. Encoding " -> &quot; and > ->
    &gt; removes both, so no breakout, no <img>, no onerror.

KEY POINTS:
  - In BOTH contexts the dangerous characters (", >, <) were converted to
    entities so the parser reads them as DATA. The difference is that the
    attribute case CRUCIALLY also encodes the delimiting quote -- that's the
    extra character the attribute context makes dangerous.
  - The displayed text is the original string in both cases (the user sees
    exactly what they typed), but nothing is parsed as a tag or handler.
  - Note: this works because the value is QUOTED. An unquoted attribute
    (value=HERE) would still be exploitable via whitespace even with these
    encodings -- always quote (Chapter 3).