Reflected XSS into attribute with angle brackets HTML-encoded