script svg onload confirm testing xss1