"><a href=javascript:alert()>X</a>

"><img src=x onerror=alert(document.cookie)>"><a href="evil.com">X{{ 7*7 }}

initial commit