src=javscript:eval("document.location.href='http://google.com/';")
src=javscript:eval(String.fromCharCode(100,111,99, 117,10 9,101,110,116,46,108,111,99,97,116,105,111,110,46, 104,114,101,102,61,39,104,116,116,112,58,47,47,103 ,111,111,103,108,101,46,99,111,109,47,39,59))
Не вижу никакой разницы.