you can execute a Windows program in HTML script. Add a JavaScript section to your HTML header: Create a variable in the JavaScript tags to initialize an ActiveX object that can run commands ...

inputting valid HTML entities is not a script injection since they are not scripted tags, to begin with. “For it to be script injection it would have to be an HTML entity that eventually is ...