Here is the deliberately vulnerable PHP code used in the demos for bypassing the anti-Reflective Cross Site Scripting filter in all versions of Internet Explorer presented at BSides Las Vegas 2014