<script>alert('xxx');</script>