<a href="javascript:alert('XSS')">Click Me</a>