Form prepopulation - likely cross-site-scripting vulnerability

[johanley]

In the mechanism for pre-populating forms with the most recent data, I inject raw request params into the DOM, as part of hidden input controls in a form. (These recycle back to the original form.) That injected data is not escaped, so there's likely a problem with cross-site-scripting there.