Comment by theboss

What's sad is that not even wrong security was in place here. They didn't even try. There was NO XSS prevention.

<script>javascript</script> is the first payload you try when looking for the stupidest XSS you can find....