Reflected Xss In A Javascript Url With Some Characters Blocked - How To Test For Reflected Xss