Welcome widget

Your name comes from the URL fragment, written with innerHTML entirely in the browser — the server never sees it. Try: /welcome#name=<img src=x onerror=alert(document.domain)>