// [CRUCIBLE-SEED]
// category: xss
// severity: high
// language: csharp
// expected: XSS via Response.Write with search query reflected into HTML

using System.Web;
using System.Web.UI;

namespace App.Pages
{
    public class SearchPage : Page
    {
        protected void Page_Load(object sender, System.EventArgs e)
        {
            string q = Request.QueryString["q"];
            // Vulnerable: writing raw query parameter into page output
            Response.Write("<h2>Results for: " + q + "</h2>");
            Response.Write("<meta name=\"description\" content=\"" + q + "\">");
        }
    }
}