I have suffered a number of XSS attacks against my site. The following HTML fragment is the XSS vector that has been injected by the attacker:
<a href="mailto:"> <a href=\"http://www.google.com onmouseover=alert(/hacked/); \" target=\"_blank\"> <img src="http://www.google.com onmouseover=alert(/hacked/);" alt="" /> </a></a>
It looks like script shouldn't execute, but using IE9's development tool, I was able to see that the browser translates the HTML to the following:
<a href="mailto:"/> <a onmouseover="alert(/hacked/);" href="\"http://www.google.com" target="\"_blank\"" \?=""> </a/>
After some testing, it turns out that the \" makes the "onmouseover" attribute "live", but i don't know why. Does anyone know why this vector succeeds?