Fix part 1 for XSS issue... call page like this:

  src/compose.php?mailbox="><script>alert('Nuts!');</script>

Because this file is included in other pages, it could affect others too.