title: xss bypassing angle brackets and double quotes escaping
body: <p>Say I want to maliciously call a function which is already defined, myfunc().</p>
  
  <p>How could I achieve xss attack bypassing double quote and angle brackets escaping?</p>
  
  <pre><code>&lt;h2&gt;Profile of INPUTNAME&lt;/h2&gt;&lt;p&gt;INPUT2&lt;/p&gt;&lt;a href="INPUTURL"&gt;Homepage&lt;/a&gt;
  </code></pre>
  
  <p>(The upper case fields are user inputs)
  How could I call myfunc() without adding the script tags around it?</p>