不，如果"正确转义，则无法超越 HTML 属性值。

您的浏览器将 HTML 解析为状态机。要验证可用字符可以进行哪些状态转换，您可以在HTML5 语法规范中查找状态。在您的情况下，这些是选项：

8.2.4.38 Attribute value (double-quoted) state

Consume the next input character:

U+0022 QUOTATION MARK (")
    Switch to the after attribute value (quoted) state.
U+0026 AMPERSAND (&)
    Switch to the character reference in attribute value state, with the additional allowed character being U+0022 QUOTATION MARK (").
U+0000 NULL
    Parse error. Append a U+FFFD REPLACEMENT CHARACTER character to the current attribute's value.
EOF
    Parse error. Switch to the data state. Reconsume the EOF character.
Anything else
    Append the current input character to the current attribute's value.

如您所见，摆脱引用属性值状态的唯一方法是通过相应的引号（"或'分别）。任何其他字符只会添加到当前属性的值。即使是尖括号和控制字符在属性内也没有特殊含义。

<因此，在这种特殊情况下，如何处理和处理也无关紧要>。这不会触发：

<input type="text" value="<script>alert('No bounty for you.')</script>">