Always take into consideration that some WAFs can filter code just once, try to double the payload to bypass the WAF.