A simple JavaScript injection like this
‘-alert(1)-’
or even
\’-alert(1)//
, usually manages to pop up a vulnerable page warning box when input reflection occurs inside a script block and HTML injection is not possible.
But there are cases where the point of injection is in the middle of more...