Now this is one funny XSS discovered by Rasmus:

Now this is one funny XSS discovered by Rasmus:

You could send HTTP Cookie HTML which does not get htmlspecialchar()ed and then exploit the page for yourself only, and no other viewers.

Rare case of a XSS and low-impact, but still not nice when advanced form redirection takes place and you want to XSS exploit a single user :-)

Please test, if anybody is reading this :-D