Cross-site scripting demo code