[FranchuFranchu]

I wrote an XSS worm that turns people's names into "yay" (and the worm code) but made myself immune to it. Now someone will have to figure out how to write a counter-worm to remove the worm from the lightsaber population. Until then, the "name" feature will be permanently held hostage (by the yay worm)

[yunruse]

Toying with #name-input and setName() was quite fun; I wish I was there to see this part happen! What `onerror` did you end up using to make it recursive?

[FranchuFranchu]

This was the injected JS code:

    document.getElementById('name-input').value = document.getElementById('yay').outerHTML; setName(); console.log('yay')

The `<img>` tag I used was wrapped around a `div` element that had the `yay` id. I used `onload` instead of `onerror`, with an image link from Wikipedia.

[jeanmayer]

Ok, you took it to the next level. This is amazing

[FranchuFranchu]

You might find this interesting, if you didn't know about it already: https://en.wikipedia.org/wiki/Samy_(computer_worm) . In 2005 someone wrote an XSS worm in MySpace that made everyone follow a single person. It worked by injecting itself in the victim's profile description. It quickly reached more than a million people.