moware1969

<script>
var contentType = <%=Request.getParameter("content_type")%>;
var title = "<%=Encode.forJavaScript(request.getParameter("title"))%>";
...
//some user agreement and sending to server logic might be here
...
</script>

<a href="/share?content_type=1&title=This is a regular title&content_type=1;alert(1)">Share</a>

<iframe src="data:text/html,%3C%73%63%72%69%70%74%