title: Bypass XSS blacklist "<", ">", "&" input nvarchar
body: <p>I'm using some software that is blacklisting certain characters "&lt;", ">", "&amp;" for user submitted values.</p>
  
  <p>It isn't HTML encoding the values when displaying the submitted results (outputs all submitted results in a table).</p>
  
  <p>It stores the values in a nvarchar field in Sql Server.</p>
  
  <p>Can you find a XSS vulnerability in this blacklist approach?
  Looking to see if can get software vendor to HTML encode the output.</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>I've found that the values in the table are first output as javascript variables, and then added to the page.
  The values in the javascript are javascript encoded. The javascript encoding is doing it's job and escapes values in the string variables.</p>
  
  <p>I'm looking for xss vulnerabilities in the html rendered from this javascript string variable.</p>
  
  <p><strong>Failed Ideas</strong></p>
  
  <p>Given that uses javascript, had a go with javascript unicode representation of &lt; ></p>
  
  <p>"\u003cscript\u003ealert('hi');\u003/script\u003e"</p>
  
  <p>However as mentioned above javascript encoder is doing it's job, and just outputs as text.</p>