---
id: 5513
title: "XSS without parentheses and semi-colons"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/xss-without-parentheses-and-semi-colons"
published_at: "2020-03-20T07:50:00Z"
tags: ["xss", "portswigger", "javascript", "waf-bypass", "payload", "limited-charset", "onerror"]
phying_url: "https://phying.com/item/5513"
lang: en
---

# XSS without parentheses and semi-colons

## Summary

Gareth Heyes adapts his classic onerror/throw trick to call functions without parentheses, semicolons or newlines, enabling XSS in heavily filtered contexts.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2020-03-20T07:50:00Z
- **Original:** https://portswigger.net/research/xss-without-parentheses-and-semi-colons
- **Phying News:** https://phying.com/item/5513