No fun allowed. (XSS EXPLOIT, MERGE ASAP)