title: Could anyone tell me why / how this XSS vector works in the browser?
body: <p>I have suffered a number of XSS attacks against my site. The following HTML fragment is the XSS vector that has been injected by the attacker:</p>
  
  <pre><code>&lt;a href="mailto:"&gt;
  &lt;a href=\"http://www.google.com onmouseover=alert(/hacked/); \" target=\"_blank\"&gt;
  &lt;img src="http://www.google.com onmouseover=alert(/hacked/);" alt="" /&gt; &lt;/a&gt;&lt;/a&gt;
  </code></pre>
  
  <p>It looks like script shouldn't execute, but using IE9's development tool, I was able to see that the browser translates the HTML to the following:</p>
  
  <pre><code>&lt;a href="mailto:"/&gt;
  &lt;a onmouseover="alert(/hacked/);" href="\"http://www.google.com" target="\"_blank\"" \?=""&gt;
  &lt;/a/&gt;
  </code></pre>
  
  <p>After some testing, it turns out that the \" makes the "onmouseover" attribute "live", but i don't know why. Does anyone know why this vector succeeds?</p>