Facebook Application XSS (basicly you can load also any image to the user ex. the google logo) http://apps.facebook.com/funny_pho_to_widget/?shared= I'm not able to inject other js functions (that are encoded or removed) ... so I'm a bit stuck with the fact that I cannot use the cookies. I will add more informations if I can do something different from a stupid and useless alert.