doctype html html body a(href= "javascript:hello('" + xss.apply(input, "js", "uri", "html") + "')")