title: Cross Site Scripting injection
body: <p>I am testing a web application. I want to write an <code>XSS</code> script that will display an alert <code>"Hello"</code>. </p>
  
  <p>The first script I wrote was:    </p>
  
  <pre><code>&lt;script &gt;alert("Hello");&lt;/script &gt; 
  </code></pre>
  
  <p>But did not display the alert <code>"Hello"</code>. I discovered that the <code>XSS</code> script that works is </p>
  
  <pre><code>&lt;SCRIPT &gt;alert(String.fromCharCode(72,101,108,108,111,33))&lt;/SCRIPT &gt;
  </code></pre>
  
  <p><em><strong>I would like to know why the first script didn't work.</em></strong> </p>