jquery - Executing javascript present in the value field of inputs - JavaScript -

i have form in html:

<form name="foo" action="http://localhost:3000/my_url" method="post">    <input type="text" name="username" value="alert('hello')" > </form> 

i need javascript in value field input execute, through form's submit. reason page template don't control (can't have

<script>    var input = document.getelementsbyname("username"); </script> 

or other <script>tag added page. i'm trying prove that's possible attack take place on malformed <input> fields, specially using templates. how can have javascript execute on form submission? remember i'm not allowed modify page content except piece. since i'm doing post form, can set <input> field (and <input> field) whatever want.

username=<script>alert('hello')<script> <input type="text" name="username" value="<script>alert('hello')<script>" > 

or

username=window.onload = function() { alert('hello') } <input type="text" name="username" value="window.onload = function() { alert('hello') }" > 

i have thought doing

username=document.forms['myform'].onsubmit() = function() { alert('hello') } <input type="text" name="username" value="document.forms['myform'].onsubmit() = function() { alert('hello') }" >  

all of valid. need javascript in tag execute. how can that? security flaw how the` tag can exploited if not sanitized. per @guest271314 "requirement include adding tag ..."

when use template engine render html content server sanitize , escape prevent passive injection of cross site scripts or xss short.

such attack can achieved on server not enforce mentioned security measures posting malformed content happily rendered later template engine.

for example form sends user input

<form name="foo" action="http://localhost:3000/my_url" method="post">    <input type="text" name="username" value="" > </form> 

if user sends "><script>alert('foo')</script> , later display input in form

<form name="bar" action="http://localhost:3000/my_other_url" method="post">     <input type="text" name="username" value="@template_engine_render(posted_username_value)@" > </form> 

the resulting output be

<form name="bar" action="http://localhost:3000/my_other_url" method="post">     <input type="text" name="username" value="">     <script>alert('foo')</script> </form> 

because "> caracters close input tag , end executing arbitrary user javascript code in page.

this why "never trust user input" 1 of basic security rules of web.