Some alternatives: #1 <script>alert()</script> (no need for an empty string) #4 '+alert()+' #6 you can also use a protocol-relative url //google.com/jsapi?ca

Some alternatives: #1 <script>alert()</script> (no need for an empty string) #4 '+alert()+' #6 you can also use a protocol-relative url //google.com/jsapi?callback=alert