<h1> <? echo $y->title; ?> </h1> You forgot htmlspecialchars and now you have XSS. Which is why facebook built XHP originally: https://www.facebook.com/notes

<h1> <? echo $y->title; ?> </h1> You forgot htmlspecialchars and now you have XSS. Which is why facebook built XHP originally: https://www.facebook.com/notes/facebook-engineering/xhp-a-new-way-to-write-php/294003943919/ https://www.facebook.com/notes/facebook-engineering/xhp-a-ne...