Double-Decoded Search
HackerMart added a gateway rule that rejects obvious angle brackets in the decoded q parameter. The application later decodes the value again before rendering it, creating a validation/interpretation mismatch.
Objective
Use URL encoding so the gateway sees harmless text but the application renders executable HTML after a second decode.