Internet Explorer whitespace-as-comment hack to bypass input filters

When testing for XSS (cross-site scripting) issues, you often need to bypass filters and perform different sorts of encodings and other trickery. To be a good tester you also need to know how the browsers you're concerned with behave differently. In Internet Explorer 6.0 there's a behavior that's allowed seemingly impassible input validation filters to be bypassed. Note that the issue is not the browser's fault, it's the fault of an improperly designed input validation mechanism on the server. Okay to illustrate the point.

You're testing a web app that has an input field. Some script tags are allowed but <img src="something"> is not. By replacing the whitespace with a comment, your code is accepted. When returned to the browser, IE 6.x, the comment is interpreted as whitespace and the code is executed fine. Test it out:
//Start HTML
<img/*comment*/src="javascript:alert('img tag')">
//End HTML

This trick can be useful for more than just bypassing filters...