most simple XSS just use <script>alert(1)</script>