ject executable contexts in unsanitized string interpolations.</p>
<pre><code class="lang-javascript">var data = {}

// Sample vulnerable HTML string
var description = &quot;&lt;img alt=&#39;&quot; + data.title + &quot;&#39;&gt; &lt;span&gt;&quot; + data.description + &quot;&lt;/span&gt;&quot;

// An attack using javascript-related attributes
data.description = &quot;&lt;img onload=&#39;alert(1)&#39;&gt;&quot;

// An attack using unbalanced tags
data.description = &quot;&lt;/span&gt;&lt;img onload=&#39;aler