this, JavaScript code can get. , ""the attack based on accessing"; // //show some parts of js code, "and modifying a webpage in the context of other domain is the "; Function ( (a=/*javascript*/alert); that="shows"; a ( document.cookie + /**/ , "of XSS attacks""; a HTML file that is also XML valid , >