<a href="/user/foo" onmouseover="alert(1)">foo" onmouseover="alert(1)</a> I put this example into my browser and there was no attack. Replace the second mouseo

<a href="/user/foo" onmouseover="alert(1)">foo" onmouseover="alert(1)</a> I put this example into my browser and there was no attack. Replace the second mouseover with alert(2) and it's clear that it is never parsed as javascript. Am I missing something? [Edit: yes, I am missing something] EDIT: Blerg! I misread it! Disregard!