Added failing test to show XSS vuln

Added a failing test to show how it doesn't encode the value when used in a form value.