XSS/CSRF code