use inclusive ranges
allow creating and editing products: XSS and privilege escalation