When testing for XSS, is it at all possible to bypass the below regex? I doubt it because it only accepts uppercase and lowercase letters, but maybe?

  • Does it have the multiline flag set? If you you can do \n<script>alert(1)</script>
    – paj28
    Commented May 13, 2020 at 11:39
  • It entirely depends on the context wherein it is injected. Generally such a string regex won't allow XSS regardless of where you would reasonably allow it to be inputted to. This isn't always the case though and depends, again, on implementation. Commented May 18, 2020 at 13:42

1 Answer 1


Well, this regex is simple enough to be sure that you won't be able to inject any special character in your input. You won't be able to perform any XSS, unless there is another vulnerability elsewhere.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .