mistakes + XSS