reflected XSS into a JavaScript string with angle brackets and double quotes HTML-encoded