add Content Security Policy in PHP to permanently avoid XSS injection if they ever try again (already weeks after I added escaping and it didn't happen) fly.pieter.com #pieter