http://www.example.com/<IMG SRC="javascript:alert('XSS');">