Today I finally looked at the patch Markus Lude sent me for Oddmuse. It was possible to do the following, for example:
http://www.emacswiki.org/cgi-bin/alex?action=rc;days=%3cscript%3ealert('gotcha')%3c%2fscript%3e
This should no longer work as all parameters are HTML-quoted. I’m not sure where *not* quoting would ever make sense. So I think not much else is needed. If you notice anything unusual, you know who you’re gonna call: ♪ Ghostbusters! ♫ Anyway, should be fixed by now.