<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd" [<!ENTITY nbsp "'">] > <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="ja" lang="ja"> <head> <title>XHTML Entity Hijacking Example</title> </head> <body> <p onclick="alert('1 )+alert( 2')">&nbsp; = </p> </body> </html> 解説 DOCTY