Cross-site scripting attacks are possible

[jbothma]

We weren't concerned with security for this project, so we hardly considered cross-site scripting.

Before running this publicly, this should be fixed to avoid easy cheating or worse - malicious users exploiting vulnerabilities in your users' browsers with injected code.