=== Message

"xxx" is taken from the request parameters and not sanitized before use.