diff --git a/docs/labs/xss.html b/docs/labs/xss.html
index 8f2bd307..0478cfbc 100644
--- a/docs/labs/xss.html
+++ b/docs/labs/xss.html
@@ -7,75 +7,11 @@
 <link rel="stylesheet" href="checker.css">
 <script src="js-yaml.min.js"></script>
 <script src="checker.js"></script>
+<script src="xss.js"></script>
 <link rel="license" href="https://creativecommons.org/licenses/by/4.0/">
 
 <!-- See create_labs.md for how to create your own lab! -->
 
-<!-- Sample expected answer -->
-<script id="expected0" type="plain/text">
-    autoescape=select_autoescape()
-</script>
-<script id="expected1" type="plain/text">
-  <h1>Hello {{ person }}!</h1>
-</script>
-<script id="expected2" type="plain/text">
-  result = Markup('Original name=') + name
-</script>
-
-<!-- Full pattern of correct answer -->
-<!-- TODO -->
-<script id="correct0" type="plain/text">
-\s* autoescape = select_autoescape \( \) \s*
-</script>
-<script id="correct1" type="plain/text">
-\s* < h1 >Hello\x20{{ person }}!< /h1 > \s*
-</script>
-<script id="correct2" type="plain/text">
-\s* result = Markup \( ('Original name='|"Original name=") \) \+ name \s*
-</script>
-
-<script id="info" type="application/yaml">
----
-hints:
-- absent: |-
-    autoescape
-  text: Add an `autoescape=` parameter.
-- present: |-
-    autoescape [^:\x20]
-  text: The name `autoescape` needs to be followed by `=`.
-- present: |-
-    (Autoescape|AUTOESCAPE)
-  text: The name `autoescape` must be in all lowercase.
-- present: |-
-    ([Aa]uto_[Ee]scape|AUTO_ESCAPE)
-  text: Use `autoescape` in all lowercase with no underscores.
-- present: |-
-    \| safe
-  index: 1
-  text: The text `| safe` indicates that this text is trusted and should
-    not be escaped further. However, in context this data could be provided
-    from an attacker and is NOT safe. Remove the marking.
-- present: |-
-    \|
-  index: 1
-  text: The `|` is used to separate the computed value from the safe marking,
-    but we will not use that marking. Remove the vertical bar.
-- present: |-
-    Markup \(.*\+.*\)
-  index: 2
-  text: Having a concatenation (+) *inside* the call to Markup
-    is a vulnerability.
-    The call to Markup presumes we are passing text that is *not* supposed
-    be escaped. If it is supposed to be escaped, it should be concatenated
-    outside the initial construction of the Markup object.
-- absent: |-
-    \+
-  index: 2
-  text: Our expected answer includes concatentation using `+`.
-    We expect something like `Markup('Original name='` followed by `+`
-    followed by the variable containing the data that needs to be escaped.
-# debug: true
-</script>
 </head>
 <body>
 <!-- For GitHub Pages formatting: -->
