# What's in a tag name? JavaScript, apparently

DevFeed: [What's in a tag name? JavaScript, apparently](<https://devfeed.tech/articles/what-s-in-a-tag-name-javascript-apparently-7721.md>)

Original publisher: [Read original article](<https://portswigger.net/research/whats-in-a-tag-name-javascript-apparently>)

Author: Gareth Heyes

Published: 2026-08-25T14:24:32Z

Content type: article

Language: en

Sources: [PortSwigger Research](<https://devfeed.tech/sources/portswigger-research.md>)

Topics: [JavaScript](<https://devfeed.tech/topics/javascript.md>), [browser](<https://devfeed.tech/topics/browser.md>), [HTML](<https://devfeed.tech/topics/html.md>), [Developer Tools](<https://devfeed.tech/topics/developer-tools.md>), [Web Development](<https://devfeed.tech/topics/web-development.md>)

Tags: [browser](<https://devfeed.tech/tags/browser.md>), [eval](<https://devfeed.tech/tags/eval.md>), [event](<https://devfeed.tech/tags/event.md>), [html](<https://devfeed.tech/tags/html.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [payload](<https://devfeed.tech/tags/payload.md>), [vector](<https://devfeed.tech/tags/vector.md>)

## AI overview

The article explores unusual HTML tag-name and attribute behaviors that can be combined with JavaScript features to create XSS vectors and potentially bypass web application firewalls. It discusses case transformations, event handlers, the Function constructor, eval, focusability, and alternative HTML attributes across browsers.

## Source excerpt

I was on my laptop, as I often am when there's rubbish on telly, and found myself wondering what characters are allowed in a tag. I knew they had to begin with "a-zA-Z", but what about after that? I t