2 ms·

If you're using this in your site as it stands, you are opening up XSS attacks as it does not appear to sanitise user input.

• tantalor 8y ago
  Only if you do something silly like serve cookies on that domain
  • comesee 8y ago
    I think this is ignoring the content of his warning and is a tautology. "it's only opens up an attack if you allow the attack vector"