<script>Hello World</script>
  Code section
  <img src="validUrl" onload=alert(document.cookie)>