xss script to test for work