Need I point out the irony of an authentication site containing an XSS attack?

Login Name: " onfocus="alert(1)" foo="

Submit form. Get error. Click input box again. XSS. Now, if I was an attacker, I would create a form which does this by myself and then post to that URL to get that javascript there when they visit the page, so as soon as they click the username it runs my JS.

Edit: This is on the create-an-account form.