p0wned now with XSS (in Firefox)
shortcut for xss URL added to README
fixes to sql injection