javascript - How to make XSS vulnerable box -

i wanna make little input box user can submit code , happen put

    <script>alert("this alert")</script>

then alert pop on page need education purposes

      <form><input type="text" name="xss"><input type="submit"></form>     <p>result: <?= $_get['xss'] ?></p>

thats have tried doesnt work , w3c not cover how make xss vulnerable input

there several ways this. 1 person suggested indeed use eval(). following:

<input type='text' id='vulnbox' value="alert('hello');"/> <button onclick="eval(document.getelementbyid('vulnbox').value)">test</button>

here's corresponding fiddle example jsfiddle

if interaction more client server use $_get in php read malicious javascript url , output contents of page.

so visit page url like:

yoursite.com?xss=%3cscript%3ealert()%3c%2fscript%3e

and php file contain:

<?php echo urldecode($_get['xss']); ?>

hope helps!

Shefl