"${User.name}"

Pronounced as: <script>alert('XSS ?')</script>

Pronouns: <script>alert('XSS ?')</script>