Wow, only bit of user input, and I left a script injection attack.