a simple xss attack to use