html injection deface code example

Example: html injection

var userposition=location.href.indexOf("user=");
        var user=location.href.substring(userposition+5);
        document.getElementById("Welcome").innerHTML=" Hello, "+user;