diff --git a/XSS/XSS_level4.php b/XSS/XSS_level4.php
new file mode 100644
index 0000000..ded848d
--- /dev/null
+++ b/XSS/XSS_level4.php
@@ -0,0 +1,22 @@
+<!DOCTYPE html>
+<html>
+<head>
+	<title>XSS 4</title>
+</head>
+<body>
+<form method="GET" action="" name="form">
+   <p>Your name:<input type="text" name="username"></p>
+   <input type="submit" name="Gönder">
+</form>
+<?php 
+if (isset($_GET["username"])) {
+    $values = array("script", "prompt", "alert", "h1");
+
+ 	$user = str_replace($values, " ",$_GET["username"]);
+	echo "$user";
+}
+
+ ?>
+
+</body>
+</html>
