On: Break Google

[ahlatimer]

Unlikely. You'd have to get someone else to run the same query.

[exogen → ahlatimer]

...which you can do simply by posting a link anywhere.

Edit: I guess it would be more helpful to explain why for those not familiar with XSS. If all it takes it a specially crafted URL to your site to exploit it, your site is toast. The security model of the web assumes that people can open even the shadiest of links without negative consequences. I could have obscured the URL with a shortener and named the link "Cutest cat pic ever!" I could have hosted a page on a totally separate domain and put the crafted URL in a hidden iframe. All I have to do is send document.cookie over to my server and now I control your account.

[ahlatimer → exogen]

My mistake. I thought it didn't work if you linked to it directly. It turns out the bug just manifests itself differently if you do that.

[inconditus → exogen]

Or iframe it.