Hey so I want to draw your attention to this, because it's easy to miss, but it's pretty important. This basically takes the raw `?user=` argument, and prints it on the page. The problem is, you can't trust user input! It's possible for someone to change the `?user=` argument into something you don't expect.

For example, `/birthdays?user=<b>someuser</b>` would print "someuser" bolded. That looks fairly harmless, but there's nothing stopping the arbitrary HTML from being a `<script>` tag, which could be used to wreak havoc. 

This is fairly simple though :) You just need to escape any potential HTML, like so:

    user => LJ::ehtml( $r->get_args->{user} );