parentheses alternatives in JS , if any?
<p>I have found that Cross Site Scripting vulnerability in a client's application. The problem is that the vulnerable parameter does not accept parentheses. So something like <code>alert(document.cookie)</code> will be rejected because of parentheses. I can get XSS using <code>alert `xss`</code> but I my client requires a proof of being able to access the DOM.</p>

<p>In other words, How can I <code>alert(document.cookie)</code> without parentheses , are there any alternatives?</p>

<p>Thanks!</p>