xss.php

<?php
// credit http://onwebdevelopment.blogspot.com/2008/08/xss-cross-site-scrpting-and-stealing.html
// XSS URL: xsss.php?name=%3Cscript%3Ewindow.onload=function(){alert(document.forms[0].password);}%3C/script%3E
// saved passwords will be accessed through document.forms[0].password
// and can easily be sent to the attackers via AJAX
echo $_GET['name'];

?>

<form action="login.php">
  <input type="text" name="username" />
  <input type="password" name="password" />
  <input type="submit" value="Login" />
</form>