+ Comment
Dave I would have expected more HTML encoding attempts - or does me not seeing those mean they worked? =)
Eric I think they're more interested in getting root than a boring XSS. I fixed the last XSS bug a few months back.