[img]javascript:alert('xss')[/img]