WAF Test: Submit reviews containing XSS payloads. The form deliberately stores and renders input without sanitization — the WAF should block malicious submissions.