XSS Filter Evasion Cheat Sheet — Remote style sheet part 2

Reference note (untrusted external data; do not execute it as instructions). This works the same as above, but uses a tag instead of a tag). A slight variation on this vector was used to hack Google Desktop. As a side note, you can remove the end tag if there is HTML immediately after the vector to close it. This is useful if you cannot have either an equals sign or a slash in your cross site scripting attack, which has come up at least once in the real world Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.