CSP demo

Payload

Server executes the below PHP code:

		if (isset($_POST['xss']) && $_POST['xss'] === 'alert(1)') {
			echo "<p onclick=" . htmlentities($_POST['xss']) . ">click me!</p>";
		}
	

Leading to an obvious XSS

Result

Retry

Now, click the below link to try the same, but this time, with a Content-Security-Policy

Check the other showcases