It actually isn't. This example won't execute on page load, but it will if someone clicks in the search box. http://fluin.com/?search=Search%22%20onclick=alert

It actually isn't. This example won't execute on page load, but it will if someone clicks in the search box. http://fluin.com/?search=Search%22%20onclick=alert%28document.cookie%29%20onfocus=%22 http://fluin.com/?search=Search%22%20onclick=alert%28documen... Since you're using PHP, I recommend you use a function like htmlspecialchars here rather than whatever kind of filtering you're doing.