There is an XSS vuln on the website. Try entering something like '<b>test</b>' or '<script>alert('test');</script>" into the text box.
What I am getting at is that you can't form a url that will do this, you need to interact with the page to trigger it.