1 2 3 4
<!DOCTYPE html> <meta charset=utf-8> <title>invalid formaction: userinfo-password-contains-pile-of-poo</title> <input type=submit formaction="http://foo:💩@example.com">