Shazzer logo

Characters allowed as start of HTML tag name

Firefox logo 53
Edge logo 53
Chrome logo 53

Characters that are possible starts of HTML tag names, for use in "custom tags" on https://portswigger.net/web-security/cross-site-scripting/cheat-sheet

Created by: JorianWoltjer

Created on: Friday, January 30, 2026 at 12:48:10 PM

Updated on: Friday, January 30, 2026 at 12:49:03 PM


Category: HTML Parsing

Vector visibility: Public

Vector type: XSS

Vector charset: UTF-8

Template used:
<$[chr]a id="test">
Code used after fuzz:
document.getElementById('test') && log(i)
Your browser was detected as:
Detecting... Detecting... Detecting... Detecting...

Sample payloads

<<a id="test">
<Aa id="test">
<Ba id="test">
<Ca id="test">
<Da id="test">
<Ea id="test">
<Fa id="test">
<Ga id="test">
<Ha id="test">
<Ia id="test">
<Ja id="test">
<Ka id="test">
<La id="test">
<Ma id="test">
<Na id="test">
<Oa id="test">
<Pa id="test">
<Qa id="test">
<Ra id="test">
<Sa id="test">

Fuzz results

Chrome logo
Chrome 144.0.0.0 desktop Windows NT 10.0

Updated

Fri Jan 30 2026
Found 53 results
Loading...
Firefox logo
Firefox 147.0 desktop Windows NT 10.0

Updated

Fri Jan 30 2026
Found 53 results
Loading...
Edge logo
Microsoft Edge 144.0.0.0 desktop Windows NT 10.0

Updated

Fri Jan 30 2026
Found 53 results
Loading...