Modify the snippet you provided in order to avoid this kind of vulnerability, but provide one (a back end one) that allows the attacker to perform a stored XSS attack. Use either PHP or nodejs for the backend.