I was looking through the OWASP XSS Filter Evasion Cheat Sheet, and there was one technique that was completely new to me:

& JavaScript includes
<BR SIZE="&{alert('XSS')}">

I tried out the following HTML:

        <br size="&{alert('1')}">

on Firefox 31.0 and it didn't seem to work (i.e. no alert box). Did I miss anything, or is this technique only applicable to older browsers?

  • 1
    html5sec.org has some newer XSS methods. I checked the documentation for the <br /> tag and it doesn't mention any attributes.
    – Vinayak
    Commented Aug 8, 2014 at 7:00

1 Answer 1


JavaScript, the Definitive Guide, 4th Edition - published in 2001 - mentions these in a bit more detail. The relevant section appears to be freely available. It's right at the bottom of that link. Here's the excerpt:

12.2.5. JavaScript in Nonstandard Contexts

Both Netscape and Microsoft have implemented proprietary extensions in their browsers, and you may occasionally see JavaScript code in a context other than those described here. For example, Internet Explorer allows you to define event handlers in a <script> tag that uses special for and event attributes. Netscape 4 allows you to use JavaScript as an alternative syntax for defining CSS style sheets within a <style> tag. Netscape 4 also extends the HTML entity syntax and allows JavaScript to appear within entities (but only within the values of HTML attributes). This can result in HTML that looks like this:

<table border="&{getBorderWidth( )};"> 

Finally, Netscape 4 also supports a form of conditional comment based on this JavaScript entity syntax. Note that Netscape 6 and the Mozilla browser on which it is based no longer support these nonstandard uses of JavaScript.

So it's an abuse of the typical HTML entity syntax - the kind where we use &amp; to produce an ampersand. Instead of writing amp, I write {alert('oh no')}.

However, the book mentions that Netscape 6 - released in 2000, around the time of IE6 - and the very early Mozilla browser were already taking action to eliminate this exploit. It's fairly unlikely it exists in recent browser versions.

If it ever affected Internet Explorer (which isn't mentioned as even permitting this in the first place), I have no information on at what version it ceased being a viable IE exploit.

  • 2
    Indeed this was only ever implemented on the legacy Netscape (≤4) family and not IE or any other browser. It is no longer of practical use as an evasion mechanism.
    – bobince
    Commented Aug 8, 2014 at 11:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .