Forging...

Entities after protocol-relative URL

Tests which entities are allowed after a protocol-relative URL

Shazzer Master

Created byhackvertor

Created Apr 3, 2026

Updated Sep 5, 2026

Unable to render tweet button

Detecting browser...

CategoryEntity Parsing

VisibilityPublic

TypeJS

CharsetUTF-8

$[data1] placeholderhtml_entities

Code used before fuzz:

const div = document.createElement('div')

Template used:

div.innerHTML='<a href="//$[data1]example.com">';
if(div.querySelector('a').host === 'example.com') {
   log('$[data1]');
}

Sample payloads

div.innerHTML='<a href="//&af;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&af;');
}

div.innerHTML='<a href="//&ApplyFunction;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&ApplyFunction;');
}

div.innerHTML='<a href="//&bsol;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&bsol;');
}

div.innerHTML='<a href="//&commat;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&commat;');
}

div.innerHTML='<a href="//&ic;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&ic;');
}

div.innerHTML='<a href="//&InvisibleComma;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&InvisibleComma;');
}

div.innerHTML='<a href="//&InvisibleTimes;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&InvisibleTimes;');
}

div.innerHTML='<a href="//&it;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&it;');
}

div.innerHTML='<a href="//&NegativeMediumSpace;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&NegativeMediumSpace;');
}

div.innerHTML='<a href="//&NegativeThickSpace;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&NegativeThickSpace;');
}

div.innerHTML='<a href="//&NegativeThinSpace;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&NegativeThinSpace;');
}

div.innerHTML='<a href="//&NegativeVeryThinSpace;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&NegativeVeryThinSpace;');
}

div.innerHTML='<a href="//&NewLine;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&NewLine;');
}

div.innerHTML='<a href="//&NoBreak;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&NoBreak;');
}

div.innerHTML='<a href="//&shy;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&shy;');
}

div.innerHTML='<a href="//&sol;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&sol;');
}

div.innerHTML='<a href="//&Tab;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&Tab;');
}

div.innerHTML='<a href="//&ZeroWidthSpace;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&ZeroWidthSpace;');
}

div.innerHTML='<a href="//&zwj;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&zwj;');
}

div.innerHTML='<a href="//&zwnj;example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&zwnj;');
}