l3v1ks worst comments
-1
test'<h1>qwe</h1>" http-equiv="refresh" content="0;url=nojavascript...console.log(document.cookie)