raw HTML reflection

q is inserted unescaped into the HTML body. Expect script/img/svg execution.