the username is vulnerable to XSS