Reflected XSS into a JavaScript string with angle brackets and double quotes