[sgdesign]

That didn't do anything for me. I'd hope WordPress escapes MySQL and JS code from query strings, that seems like a pretty big vulnerability…