You failed to sanitize the form inputs. The site is xss vulnerable.