Even more, one could rename the default 'example' page like this: http://boxify.me/box/input-script-alert-string-fromcharcode-88-83-83-script http://boxify.me/b

Even more, one could rename the default 'example' page like this: http://boxify.me/box/input-script-alert-string-fromcharcode-88-83-83-script http://boxify.me/box/input-script-alert-string-fromcharcode-... :) Edit: removed the XSS, but here's the vector (if HN allows: input"><script>alert(String.fromCharCode(88,83,83))</script>)