> For the complete documentation index, see [llms.txt](https://www.pwny.cc/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.pwny.cc/web-attacks/cross-site-scripting-xss/xss-tips.md). # XSS Tips ### Tips & Tricks * `http(s)://` can be shortened to `//` or `/\\` or `\\`. * `document.cookie` can be shortened to `cookie`. It applies to other DOM objects as well. * alert and other pop-up functions don't need a value, so stop doing `alert('XSS')` and start doing `alert()` * You can use `//` to close a tag instead of `>`. * I have found that `confirm` is the least detected pop-up function so stop using `alert`. * Quotes around attribute value aren't necessary as long as it doesn't contain spaces. You can use `