XXS

injection point 1

<div>
{name} {surname}
</div>

name = <script>alert(1)</script>
surname = szalkowski

<div>
<script>alert(1)</script> szalkowski
</div>

injection point 2

<div id="{name}">
 {surname}
</div>

name = 1"></div><script>alert(1)</script><div id="2
surname = szalkowski

<div id="1"></div><script>alert(1)</script><div id="2">
 szalkowski
</div>