<script>alert("does XSS is allowed?");</script> aaaa