762764-1.html (577B)
1 <!DOCTYPE html> 2 <script> 3 4 function boom() 5 { 6 document.documentElement.removeChild(document.body); 7 var newBody = document.createElementNS("http://www.w3.org/1999/xhtml", "body"); 8 document.documentElement.appendChild(newBody); 9 newBody.contentEditable = "true"; 10 document.execCommand("inserthtml", false, "<textarea>a</textarea>"); 11 document.execCommand("insertimage", false, "1.jpg"); 12 try { document.execCommand("forwardDelete", false, null); } catch(e) { } 13 document.execCommand("inserthtml", false, "x<span><\/span>y"); 14 } 15 16 </script> 17 18 <body onload="boom();"></body>