[n_]

On level 3:

  https://xss-game.appspot.com/level3/frame#'/><script>alert(1)</script>

will execute on load rather than after user input.

[maaarghk]

yeah, as the notes say you would use onload IRL.