Description:
------------
When the xhprof_html directory is deployed it makes the site vulnerable to a Reflected XSS attack by not properly escaping the run parameter.

1. find a site with a xhprof_html deployed
2. change the run parameter to include <script>...</script> (e.g. /xhprof/?run=%3Cscript%3Ealert('XSS');%3C/script%3E)
3. load the page
4. notice the JS alert

NB: XSS filters in some browsers might block this attack



Expected result:
----------------
JavaScript is not executed, input is properly sanitized and/or escaped.

Actual result:
--------------
JavaScript is executed in the context of the user visiting the page.