---
id: 5463
title: "The seventh way to call a JavaScript function without parentheses"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses"
published_at: "2022-09-18T17:20:00Z"
tags: ["web-security", "javascript", "tagged-templates", "waf-evasion", "function-calls", "language-quirks"]
phying_url: "https://phying.com/item/5463"
lang: en
---

# The seventh way to call a JavaScript function without parentheses

## Summary

Gareth Heyes documents a seventh way to call JavaScript functions without parentheses, exploiting how tagged-template placeholders are passed as typed arguments — insight for sandbox and WAF evasion.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2022-09-18T17:20:00Z
- **Original:** https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses
- **Phying News:** https://phying.com/item/5463