data sent to the browser: Here is <b>bold</b> and <img src=x onerror=alert(1)> & done