The shame! no html escaped, thus vulnerable :-(