Written by a visitor: <script>alert(1)</script> and {php:getcwd}