Payload updated

Some XSS payload result turn out uncertain, not sure why; need to
recheck