>>474
script injection(, scriptlet. w/z css extended?)
remove query papam