During an investigation of an xss attack, the investigator comes across the term "[a-za-z0-9\%]+" in analyzed evidence details. what is the expression used for?