Testing instructions Login and navigate to " User preference " Under " Badges " choose " Backpack settings " Instead writing a valid email address, enter " <script>alert(1);</script> " With some code inspector, change backpackurl hidden form value to https://pastebin.com/raw/HJWNqwnk? (make sure you have the question mark at the end). Click the "Connect to backpack" button CONFIRM the value you entered was not saved in the form and that an error was shown