[malcolmhere]

Oh wow. Would love to know you did that. :-o

[Chris_Newton]

I feel like I’m posting a spoiler here, but... Think what happens if the user’s “e-mail address” happens to start with:

    "/><script>

[TACIXAT]

Just put a script in the username field, sorry if that wasn't clear.

    <script>alert(0)</script>

All the live updating that module does, I figured there might be some code injection.