I tried testing some XSS stuff and got 500 errors, you might want to make sure you are catching encoded < > stuff