Enumerating...

Supported HTML and attributes by the Sanitizer - Shazzer

Supported HTML and attributes by the Sanitizer

Checks which HTML tags and attributes are supported by the HTML Sanitizer API. Note this excludes events.

Shazzer Elite

Created Jul 8, 2026

Updated Jul 8, 2026

Unable to render tweet button

Detecting browser...

CategoryHTML Parsing

VisibilityPublic

TypeJS

CharsetUTF-8

$[data1] placeholderhtml

$[data2] placeholderattributes

Template used:

document.body.setHTML('<$[data1] $[data2]="foo">test</b>');0x0D
document.body.innerHTML.includes('<$[data1] $[data2]') && log('$[data1]->$[data2]')

Sample payloads

Hide older browsers

Chrome 150.0.7871.101 desktop macOS 10.15.7

Updated8 Jul 2026

Found 188 results

Show differences only?

Filter out alphanumeric

Sort ascending

Firefox 152.0 desktop macOS 10.15

Updated8 Jul 2026

Found 188 results

Show differences only?

Filter out alphanumeric

Sort ascending

document.body.setHTML('<a->dir ="foo">test</b>');0x0D
document.body.innerHTML.includes('<a->dir ') && alert('a->dir->')

document.body.setHTML('<a->href ="foo">test</b>');0x0D
document.body.innerHTML.includes('<a->href ') && alert('a->href->')

document.body.setHTML('<a->hreflang ="foo">test</b>');0x0D
document.body.innerHTML.includes('<a->hreflang ') && alert('a->hreflang->')

document.body.setHTML('<a->lang ="foo">test</b>');0x0D
document.body.innerHTML.includes('<a->lang ') && alert('a->lang->')

document.body.setHTML('<a->title ="foo">test</b>');0x0D
document.body.innerHTML.includes('<a->title ') && alert('a->title->')

document.body.setHTML('<a->type ="foo">test</b>');0x0D
document.body.innerHTML.includes('<a->type ') && alert('a->type->')

document.body.setHTML('<abbr->dir ="foo">test</b>');0x0D
document.body.innerHTML.includes('<abbr->dir ') && alert('abbr->dir->')

document.body.setHTML('<abbr->lang ="foo">test</b>');0x0D
document.body.innerHTML.includes('<abbr->lang ') && alert('abbr->lang->')

document.body.setHTML('<abbr->title ="foo">test</b>');0x0D
document.body.innerHTML.includes('<abbr->title ') && alert('abbr->title->')

document.body.setHTML('<address->dir ="foo">test</b>');0x0D
document.body.innerHTML.includes('<address->dir ') && alert('address->dir->')

document.body.setHTML('<address->lang ="foo">test</b>');0x0D
document.body.innerHTML.includes('<address->lang ') && alert('address->lang->')

document.body.setHTML('<address->title ="foo">test</b>');0x0D
document.body.innerHTML.includes('<address->title ') && alert('address->title->')

document.body.setHTML('<article->dir ="foo">test</b>');0x0D
document.body.innerHTML.includes('<article->dir ') && alert('article->dir->')

document.body.setHTML('<article->lang ="foo">test</b>');0x0D
document.body.innerHTML.includes('<article->lang ') && alert('article->lang->')

document.body.setHTML('<article->title ="foo">test</b>');0x0D
document.body.innerHTML.includes('<article->title ') && alert('article->title->')

document.body.setHTML('<aside->dir ="foo">test</b>');0x0D
document.body.innerHTML.includes('<aside->dir ') && alert('aside->dir->')

document.body.setHTML('<aside->lang ="foo">test</b>');0x0D
document.body.innerHTML.includes('<aside->lang ') && alert('aside->lang->')

document.body.setHTML('<aside->title ="foo">test</b>');0x0D
document.body.innerHTML.includes('<aside->title ') && alert('aside->title->')

document.body.setHTML('<b->dir ="foo">test</b>');0x0D
document.body.innerHTML.includes('<b->dir ') && alert('b->dir->')

document.body.setHTML('<b->lang ="foo">test</b>');0x0D
document.body.innerHTML.includes('<b->lang ') && alert('b->lang->')