Reflected XSS into a JavaScript string with angle brackets HTML encoded