I was wondering if appending a double quote at the end of a query is considered a valid XSS filter. Let's say we have a search function and I entered: 

"&gt;&lt;script&gt;alert('hi')&lt;/script&gt;


If I look at the source of the resulting query I will see the following:

&lt;input name="search" type="text" value=""&gt;&lt;script&gt;alert('hi')&lt;/script&gt;"&gt;


The double quote will be appended automatically at the end of my query. 

Assuming that the filter also scrubs out the null char, and HTML comments &lt;!--, would this be an effective XSS filter or is this just wishful thinking?


Question: US Tax exemption for Independent student contractor working from India
Answer: 
  Who should I pay tax to India/US state ?


India.


  Am I eligible for tax exemption from US because of US India tax treaty
  ?


No, because there's nothing to exempt.


  Do I need to fill any formal tax forms ? If yes which one W-8BEN or
  8233(asking for tax exemption) ?


You need to fill W8-BEN showing that you're not a US person for tax purposes.


  What reason should I specify for tax exemption , being an Independent
  contractor not living in US, or being a student ?


Moot since you're not liable for any taxes in the US based on the information you've provided.