sample form with XSS