< ScRiPt SrC = "xss.jpg" "" >< / sCrIpT /bogus > "> PT SRC="xss.js"> < fakevoid onload="return confirm('Wanna give me your password?');" / > '); document.write('

But include me!

'); //document.write('< / script bogus >

Also include me!