I wonder if someone could set their name to like
bob/picture/fail" onerror="alert('xss')
and xss
bob is at it again!!!