LaboCNIL/CookieViz — pull request #4 by SilentKernel (2014-11-04 16:40:10+00:00)
Title: Xss inection

http://seclists.org/fulldisclosure/2014/Nov/3
$max_date was not washed

Wash $max_date when get from $_GET could be a good idea :)
To prevent these type of breach think about to use a Framework :p