XXS
injection point 1
<div>
{name} {surname}
</div>
name = <script>alert(1)</script>
surname = szalkowski
<div>
<script>alert(1)</script> szalkowski
</div>
injection point 2
<div id="{name}">
{surname}
</div>
name = 1"></div><script>alert(1)</script><div id="2
surname = szalkowski
<div id="1"></div><script>alert(1)</script><div id="2">
szalkowski
</div>