> Some of these are ingenius. Placing an input box far down a page, setting it to autofocus, and then reacting to body onscroll? Although this sounds quite cle

> Some of these are ingenius. Placing an input box far down a page, setting it to autofocus, and then reacting to body onscroll? Although this sounds quite clever, I don't see the value in this. If your HTML whitelist contains "on..." attributes such as "onscroll", you have deeper issues than this clever trick. Almost certainly you are vulnerable to stuff like "onclick", too. Except if you use blacklists where you added "onclick" and forgot to add "onscroll". But in that case, if you are using blacklists instead of whitelists, you are almost certainly doomed anyway. (see https://news.ycombinator.com/item?id=4794745 https://news.ycombinator.com/item?id=4794745)