Also, you missed the login form (both in the header and on http://profile.io/login). Its echoing the username directly, e.g., "Username <script>alert(1)</script> was not found"