Find XSS payloads that actually work by filtering them based on real-world constraints instead of blind payload spraying.