tl;dr I just made a tool to transform any javascript code into an equivalent sequence of ()[]{}!+ characters. You can try it here, or grab it from github or npm. Keep on reading if you want to know how it works. Non alphanumeric JavaScript What do you know about non-alphanumeric XSS? The other day one of my friends asked me that question on IRC, pointing me to some articles on sla.ckers.org where