String exercise: return exactly "<script>alert(1)</script>". The result is compared as text and is not executed. This is not a universal XSS test: execution depends on the insertion context and page protections.
Sign in to solve this challenge — an account is free. The demo works without one.
All puzzles are free. An account unlocks the full catalog, saved progress and points.