Bypassing WAFs for Fun and JavaScript Injection with Parameter Pollution