Stored XSS into anchor href attribute with double quotes HTML-encoded