Chars that can be used as opening bracket in innerHTML

Created bynollium

Created Apr 19, 2025

Updated May 28, 2025

Detecting browser...

CategoryHTML Parsing

VisibilityPublic

TypeJS

CharsetUTF-8

Template used:

document.body.innerHTML = String.fromCodePoint($[i]) + "img src=x onerror=log($[i])  />";

Sample payloads

document.body.innerHTML = String.fromCodePoint(60) + "img src=x onerror=alert(60)  />";