Break out of CSS strings

This vector shows what characters allow you to break out of CSS strings.

Created Apr 4, 2024

Updated May 14, 2025

Detecting browser...

CategoryCSS Parsing

VisibilityPublic

TypeHTML

CharsetUTF-8

Template used:

<div style="font-family:'x$[chr];color:red;';">test</div>

Sample payloads

<div style="font-family:'x
;color:red;';">test</div>

<div style="font-family:'x0x0C;color:red;';">test</div>

<div style="font-family:'x0x0D;color:red;';">test</div>

<div style="font-family:'x';color:red;';">test</div>