Simple HTTP GET XSS vulnerability