write ?next=javascript:alert(1)