The Medium security code uses a PHP str$\_$replace function to identify

and sanitize the

$($Close the Reflected XSS Source window first.$)$ This time it works.

Because the script tag isn't case$-$sensitive but the str$\_$replace function

is$,$ you can bypass it easily.

What does the str$\_$replace function search for?