Simple HTTP POST XSS vulnerability