In an XSS attack (proof of concept for pen testing reasons), the following string is appended to a url:


I understand what the ;alert(String.fromCharCode(88,83,83)) does (it just creates an alert dialog saying "XSS"). What I don't understand is why it needs the ;(1 for it to work.

What is the need for that last piece of text? Also why have the number 1? I tried letters and different numbers and both worked.

  • 5
    it's likely to make it fit in-place without a syntax error, which would stop all code from executing. an invalid letter would name an unused variable which would error (ref er) once it got there, but not before anything ran.
    – dandavis
    Commented Jul 5, 2017 at 16:52
  • 2
    @dandavis But the string introduces an imbalance of parens. Not sure in which context that makes sense if you're not also commenting something out, etc.
    – Arminius
    Commented Jul 5, 2017 at 18:19
  • As Arminius said. Without the context is impossible to answer.
    – Siracuso
    Commented Jul 5, 2017 at 18:58
  • @Arminius: i'm explaining the part that's explainable, context would be speculative.
    – dandavis
    Commented Jul 5, 2017 at 19:08

1 Answer 1


As far as I think, the

; in ;(1 is just for ending the alert tag.

And since you haven't mentioned in which context are you using this payload, it will be best to say that the ( is simply starting because there must be another ) after that so that the two parenthesis can match.

Also, as you are concerned about 1, I think, you can write anything there "aaa" or "blahblahblah" will also work.

P.S. You have yourself mentioned in the question that both numbers and strings worked. When you are using this payload, just check in the response where does it get inserted. So that you can see by yourself how one parenthesis is used for closing the other to make a valid statement. Cheers..:)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .