Reflection xss exploitation method, bypassing IE xss filter

Reflection xss usage method, bypass ie xss Filter Suppose 1. php Page code: echo $ _ GET ['str']; use IE browser to access this page 1.php? Str = <xss code> xss fails due to XSS filter rendering. What should we do next? If the site can post, link, and so on, as long as you can send a link address, not just send a link. Because ie xss filter only checks whether the referer is from the source, Ie xss filter does not take effect if it is from the source. Now you understand, when the javascript: date: and other protocols are invalid: <a href = "http: // localhost/1.php? Str = <xss code> "> seek links </a> you can click the IE user to make a move (other browsers also make a move)