example: XSS everywhere