Reflected XSS into HTML context with nothing encoded