Fun with reflected XSS in PHP

Example XSS Attack Strings

• <script>alert(1)</script> – blocked by CSP
• <img src="x"; onerror="alert(1)"> – allowed by CSP script-src-attr directive