alert("pwned!")'> ]>

There's a nbsp here: