These tags are filtered(sanitized) and encoded in output. Detection/Probing ;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//;alert(String.fromCharCode(88,83,83))//\;alert(String.fromCharCode(88,83,83))//>>>alert(String.fromCharCode(88,83,83))&submit.x=27&submit.y=9&cmd=search disappears entirely: the application uses some kind of strip_tags . Where does the idea of selling dragon parts come from? Set a default parameter value for a JavaScript function. I am learning about XSS (for ethical purposes), and I was wondering how to execute some JavaScript code without using