<a href="javascript:alert('GOTCHA')">click me</a>
<a href="javascript:alert('GOTCHA')">click me</a>
+<a href="jscript:alert('GOTCHA')">click me</a>
+<a href="vbscript:alert('GOTCHA')">click me</a>
+<a href="java\tscript:alert('GOTCHA')">click me</a>
+<span style="any: expressio(GOTCHA)n(window.location='http://example.org/')">entity-encoded CSS script test</span>
+<span style="any: expression(GOTCHA)(window.location='http://example.org/')">entity-encoded CSS script test</span>
+<script>GOTCHA</script>
+<span style="background: url(javascript:window.location=GOTCHA)">CSS script test</span>