Number 2

alert('XSS') Click me <![CDATA[alert('XSS')]]> Click me var div = document.createElement('div'); div.innerHTML = ''; document.body.appendChild(div); document.body.appendChild(document.getElementById('xss').content);