[IMG]javascript:alert('xss')[/IMG]