Changing XSS from get to post