http://localhost/search?query=<script>alert("xss")</script>xss