Comment by qnsoaejacniln

There is XSS in the (my-name) part :)

(my-name "<img src='#' onerror=alert(1) />")