Once you're parsed the first minefield, another crop emerges: interpreting the result. Even the range of values seen in the wild for a supposedly simple boolean attribute is just mind-boggling. Setting aside all the noise from jokers trying it on with fuzzing engines, we'll see all of these presented to various APIs:

    true
    false
    null
    0 | 1
    "true" | "false"    (with assorted variation by
    "yes"  | "no"        case and initial character)
    "" | "0" | "1"
    "\u2713"            (hi DHH)
    -1                  (with complements)
    "[object Object]"
    { "value": true }   (and friends)
                        (attribute not present)
    "敵牴"

That last looks like a doozy, but old lags will guess what's going on right away. It's the octets of the 8-bit string "true", misinterpreted as UCS-2 (16-bit wide character) code points and then spat out as UTF8. Google translates it, quite appropriately, as "Enemy".

Oddly though, according to my records, never seen a "NULL".