i have href link in jsp page and destination page shows script code if hacker add the script to href

Question

first page is like this:

<a href = "javascript:test('abcd.jsp?asd=<%= asd 
%>');">
function test(x)
    { 
        document.abc.method='post';
        document.abc.action=x;
        document.abc.submit();
    }

hacker adds some script "><script>alert(12345)</script>"> code to url then submit it abcd.jsp display the alert msg which is written in script code.