https://martinotommasini.github.io/posts/Reflected-XSS-blocked-events-and-href/