Hi, TinyWebGallery 1.4.2 is not vulnerable to cross-site scripting anymore. All input parameters are now checked properly. Solution: Update to TWG 1.4. /Michael