is valid?      

Text formatted with Texy:

Generated HTML code:

<div><img src="javascript:alert('XSS');"></div>

Verze Texy: 3.1.5 (konfigurace)