title: Sanitizing HTML input value
body: <p>Do you have to convert anything besides the quotes (<code>"</code>) to (<code>&amp;quot;</code>) inside of:</p>
  
  <p><code>&lt;input type="text" value="$var"&gt;</code></p>
  
  <p>I personally do not see how you can possibly break out of that without using <code>" on*=...</code>.</p>
  
  <p>Is this correct?</p>
  
  <p><strong>Edit</strong>: Apparently some people think my question is too vague;</p>
  
  <p><code>&lt;input type="text" value="&lt;script&gt;alert(0)&lt;/script&gt;"&gt;</code> does not execute. Thus, making it impossible to break out of using without the usage of <code>"</code>.</p>
  
  <p>Is this correct?</p>