diff --git a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AttackResult.java b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AttackResult.java
index dcd2204b5..ca4219849 100644
--- a/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AttackResult.java
+++ b/webgoat-container/src/main/java/org/owasp/webgoat/lessons/AttackResult.java
@@ -34,7 +34,7 @@ import lombok.Getter;
 @Getter
 public class AttackResult {
 
-    private boolean lessonCompleted;
+    private boolean assignmentCompleted;
     private String feedback;
     private String output;
 
@@ -48,7 +48,7 @@ public class AttackResult {
 
     public static AttackResult success(String feedback, String output) {
         AttackResult attackResult = new AttackResult();
-        attackResult.lessonCompleted = true;
+        attackResult.assignmentCompleted = true;
         attackResult.feedback = feedback;
         attackResult.output = output;
         return attackResult;
@@ -60,13 +60,13 @@ public class AttackResult {
 
     public static AttackResult failed(String feedback, String output) {
         AttackResult attackResult = new AttackResult();
-        attackResult.lessonCompleted = false;
+        attackResult.assignmentCompleted = false;
         attackResult.feedback = feedback;
         attackResult.output = output;
         return attackResult;
     }
 
     public boolean assignmentSolved() {
-        return lessonCompleted;
+        return assignmentCompleted;
     }
 }
diff --git a/webgoat-container/src/main/resources/static/js/goatApp/controller/LessonController.js b/webgoat-container/src/main/resources/static/js/goatApp/controller/LessonController.js
index 6ce9932b1..a4b93ff18 100644
--- a/webgoat-container/src/main/resources/static/js/goatApp/controller/LessonController.js
+++ b/webgoat-container/src/main/resources/static/js/goatApp/controller/LessonController.js
@@ -64,8 +64,8 @@ define(['jquery',
                 this.listenTo(this.lessonContent,'content:loaded',this.onContentLoaded);
                 this.userAndInfoView = new UserAndInfoView();
                 this.menuButtonView = new MenuButtonView();
-                this.listenTo(this.lessonContentView, 'lesson:complete', this.updateMenu);
-                this.listenTo(this.lessonContentView, 'lesson:complete', this.updateLessonOverview);
+                this.listenTo(this.lessonContentView, 'assignment:complete', this.updateMenu);
+                this.listenTo(this.lessonContentView, 'assignment:complete', this.updateLessonOverview);
             };
 
             this.loadLesson = function(name,pageNum) {
diff --git a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js
index 7f0ce6794..1c51bcfd1 100644
--- a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js
+++ b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonContentView.js
@@ -114,13 +114,24 @@ define(['jquery',
             this.renderFeedback(data.feedback);
 
             this.renderOutput(data.output || "");
-            if (data.lessonCompleted) {
-                this.curForm.reset();
-                this.trigger('lesson:complete');
+            if (data.assignmentCompleted) {
+                this.markAssignmentComplete();
+                this.trigger('assignment:complete');
+            } else {
+                this.markAssignmentIncomplete();
             }
             return false;
         },
 
+        markAssignmentComplete: function () {
+            this.curForm.reset();
+            $(this.curForm).siblings('.assignment-success').find('i').removeClass('hidden');
+        },
+
+        markAssignmentIncomplete: function () {
+            $(this.curForm).siblings('.assignment-success').find('i').addClass('hidden');
+        },
+
         onErrorResponse: function (a,b,c) {
             console.error(a);
             console.error(b);
diff --git a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonProgressView.js b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonProgressView.js
index 0c3e892b1..a3b05729d 100644
--- a/webgoat-container/src/main/resources/static/js/goatApp/view/LessonProgressView.js
+++ b/webgoat-container/src/main/resources/static/js/goatApp/view/LessonProgressView.js
@@ -16,7 +16,7 @@ define(['jquery',
                 }
             },
             render: function () {
-                if (this.model.get("lessonCompleted")) {
+                if (this.model.get("assignmentCompleted")) {
                     this.$el.html(this.model.get('successMessage'));
                 } else {
                     this.$el.html("");
diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/html/CrossSiteScripting.html b/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/html/CrossSiteScripting.html
index 1e1001411..4872350dc 100644
--- a/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/html/CrossSiteScripting.html
+++ b/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/html/CrossSiteScripting.html
@@ -174,8 +174,8 @@
         which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
 		<div class="adoc-content" th:replace="doc:CrossSiteScripting_content6a.adoc"></div>
 		<div class="attack-container">
+			<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
 			<!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
-			<div id="lessonContent">
                 <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
                 <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
                 <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
@@ -193,7 +193,6 @@
 						</tr>
 					</table>
 				</form>
-			</div>
 			<!-- do not remove the two following div's, this is where your feedback/output will land -->
 			<div class="attack-feedback"></div>
 			<div class="attack-output"></div>
@@ -228,42 +227,43 @@
 		<div class="adoc-content"
 			th:replace="doc:CrossSiteScripting_content9a.adoc"></div>
 		<div class="attack-container">
+			<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
 			<!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
-			<div id="lessonContent">
-				<!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
-				<!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
-				<!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
-				<form class="attack-form" accept-charset="UNKNOWN" method="POST"
-					name="form" action="/WebGoat/CrossSiteScripting/attack9a"
-					enctype="application/json;charset=UTF-8">
-	
-					<table cellspacing="0" cellpadding="0" border="0">
-						<tbody>
-							<tr>
-								<td>Title:</td>
-								<td><input name="title" value="" type="TEXT" /></td>
-							</tr>
-							<tr>
-								<td valign="TOP">Message:</td>
-								<td><textarea cols="60" name="message" rows="5"></textarea></td>
-							</tr>
-						</tbody>
-					</table>
-					<p>
-						<input name="SUBMIT" value="Submit" type="SUBMIT" />
-					</p>
-					<hr />
-					<hr />
-					<h1>Message List</h1>
-					<table cellspacing="0" cellpadding="0" border="0">
-						<tbody>
-							<tr>
-								<td><a href="#" style="cursor: hand" link="attack?Num=1"><u></u></a></td>
-							</tr>
-						</tbody>
-					</table>
-				</form>
-			</div>
+
+			<!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
+			<!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
+			<!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
+			<form class="attack-form" accept-charset="UNKNOWN" method="POST"
+				name="form" action="/WebGoat/CrossSiteScripting/attack9a"
+				enctype="application/json;charset=UTF-8">
+
+				<table cellspacing="0" cellpadding="0" border="0">
+					<tbody>
+						<tr>
+							<td>Title:</td>
+							<td><input name="title" value="" type="TEXT" /></td>
+						</tr>
+						<tr>
+							<td valign="TOP">Message:</td>
+							<td><textarea cols="60" name="message" rows="5"></textarea></td>
+						</tr>
+					</tbody>
+				</table>
+				<p>
+					<input name="SUBMIT" value="Submit" type="SUBMIT" />
+				</p>
+				<hr />
+				<hr />
+				<h1>Message List</h1>
+				<table cellspacing="0" cellpadding="0" border="0">
+					<tbody>
+						<tr>
+							<td><a href="#" style="cursor: hand" link="attack?Num=1"><u></u></a></td>
+						</tr>
+					</tbody>
+				</table>
+			</form>
+
 			<!-- do not remove the two following div's, this is where your feedback/output will land -->
 			<div class="attack-feedback"></div>
 			<div class="attack-output"></div>
diff --git a/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/lessonPlans/en/CrossSiteScripting_content5b.adoc b/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/lessonPlans/en/CrossSiteScripting_content5b.adoc
new file mode 100644
index 000000000..f4e3b0570
--- /dev/null
+++ b/webgoat-lessons/cross-site-scripting/src/main/resources/plugin/CrossSiteScripting/lessonPlans/en/CrossSiteScripting_content5b.adoc
@@ -0,0 +1,4 @@
+== Was it Really Reflected XSS?
+
+Now, was the last attack truly reflected XSS?
+
diff --git a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/XXE.html b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/CSRF.html
similarity index 96%
rename from webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/XXE.html
rename to webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/CSRF.html
index e10652683..c2bb6e238 100644
--- a/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/XXE.html
+++ b/webgoat-lessons/csrf/src/main/resources/plugin/CSRF/html/CSRF.html
@@ -20,6 +20,7 @@
     <div class="adoc-content" th:replace="doc:XXE_simple.adoc"></div>
     <!-- if including attack, reuse this section, leave classes in place -->
     <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
         <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
         <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
@@ -69,6 +70,7 @@
     which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
     <div class="adoc-content" th:replace="doc:XXE_changing_content_type.adoc"></div>
     <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
         <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
         <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
@@ -128,6 +130,7 @@
     which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
     <div class="adoc-content" th:replace="doc:XXE_blind_assignment.adoc"></div>
     <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
         <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
         <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
diff --git a/webgoat-lessons/http-basics/src/main/resources/plugin/HttpBasics/html/HttpBasics.html b/webgoat-lessons/http-basics/src/main/resources/plugin/HttpBasics/html/HttpBasics.html
index 157cc5851..30832a279 100644
--- a/webgoat-lessons/http-basics/src/main/resources/plugin/HttpBasics/html/HttpBasics.html
+++ b/webgoat-lessons/http-basics/src/main/resources/plugin/HttpBasics/html/HttpBasics.html
@@ -15,6 +15,7 @@
 		<div class="adoc-content" th:replace="doc:HttpBasics_content1.adoc"></div>
         <!-- if including attack, reuse this section, leave classes in place -->
 		<div class="attack-container">
+			<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
 			<!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
             <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
             <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
@@ -44,8 +45,8 @@
         which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
 		<div class="adoc-content" th:replace="doc:HttpBasics_content2.adoc"></div>
 		<div class="attack-container">
+			<div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
 			<!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
-			<div id="lessonContent">
                 <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
                 <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
                 <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
@@ -81,8 +82,6 @@
 				<div class="attack-feedback"></div>
 				<div class="attack-output"></div>
 				<!-- ... of course, you can move them if you want to, but that will not look consistent to other lessons -->
-			</div>
-
 		</div>
 	</div>
 
diff --git a/webgoat-lessons/idor/src/main/resources/plugin/IDOR/html/IDOR.html b/webgoat-lessons/idor/src/main/resources/plugin/IDOR/html/IDOR.html
index 0796396bc..b5a647343 100644
--- a/webgoat-lessons/idor/src/main/resources/plugin/IDOR/html/IDOR.html
+++ b/webgoat-lessons/idor/src/main/resources/plugin/IDOR/html/IDOR.html
@@ -13,30 +13,29 @@
     which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
     <div class="adoc-content" th:replace="doc:IDOR_login.adoc"></div>
     <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
-        <div class="lessonContent">
-            <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
-            <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
-            <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
+        <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
+        <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
+        <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
 
-            <!-- modify the action to point to the intended endpoint -->
-            <form class="attack-form" accept-charset="UNKNOWN"
-                  method="POST" name="form"
-                  action="/WebGoat/IDOR/login"
-                  enctype="application/json;charset=UTF-8">
-                <table>
-                    <tr>
-                        <td>user/pass</td>
-                        <td>user:<input name="username" value="" type="TEXT" /></td>
-                        <td>pass:<input name="password" value="" type="password" /></td>
-                        <td>
-                            <input
-                                name="submit" value="Submit" type="SUBMIT"/>
-                        </td>
-                    </tr>
-                </table>
-            </form>
-        </div>
+        <!-- modify the action to point to the intended endpoint -->
+        <form class="attack-form" accept-charset="UNKNOWN"
+              method="POST" name="form"
+              action="/WebGoat/IDOR/login"
+              enctype="application/json;charset=UTF-8">
+            <table>
+                <tr>
+                    <td>user/pass</td>
+                    <td>user:<input name="username" value="" type="TEXT" /></td>
+                    <td>pass:<input name="password" value="" type="password" /></td>
+                    <td>
+                        <input
+                            name="submit" value="Submit" type="SUBMIT"/>
+                    </td>
+                </tr>
+            </table>
+        </form>
         <!-- do not remove the two following div's, this is where your feedback/output will land -->
         <div class="attack-feedback"></div>
         <div class="attack-output"></div>
@@ -50,23 +49,22 @@
     which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
     <div class="adoc-content" th:replace="doc:IDOR_viewDiffs.adoc"></div>
     <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
-        <div>
-            <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
-            <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
-            <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
+        <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
+        <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
+        <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
 
-            <!-- modify the action to point to the intended endpoint -->
-            <form class="attack-form" accept-charset="UNKNOWN"
-                  method="GET" name="form"
-                  action="/WebGoat/IDOR/profile"
-                  enctype="application/json;charset=UTF-8">
-                <script th:src="@{/plugin_lessons/plugin/IDOR/js/idor.js}" />
+        <!-- modify the action to point to the intended endpoint -->
+        <form class="attack-form" accept-charset="UNKNOWN"
+              method="GET" name="form"
+              action="/WebGoat/IDOR/profile"
+              enctype="application/json;charset=UTF-8">
+            <script th:src="@{/plugin_lessons/plugin/IDOR/js/idor.js}" />
 
-                <input name="View Profile" value="View Profile" type="button" onclick="onViewProfile();" />
+            <input name="View Profile" value="View Profile" type="button" onclick="onViewProfile();" />
 
-            </form>
-        </div>
+        </form>
         <div id="idor-profile"></div>
         <!-- do not remove the two following div's, this is where your feedback/output will land -->
         <div class="attack-feedback"></div>
@@ -75,21 +73,20 @@
     </div>
 
     <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
-        <div class="lessonContent">
-            <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
-            <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
-            <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
-            <div class="adoc-content" th:replace="doc:IDOR_whatDiffs.adoc"></div>
-            <!-- modify the action to point to the intended endpoint -->
-            <form class="attack-form"
-                  method="POST" name="diff-form"
-                  action="IDOR/diff-attributes"
-                  enctype="application/json;charset=UTF-8">
-                <input name="attributes" type="text" />
-                <input name="Submit Diffs" value="Submit Diffs" type="submit" />
-            </form>
-        </div>
+        <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
+        <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
+        <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
+        <div class="adoc-content" th:replace="doc:IDOR_whatDiffs.adoc"></div>
+        <!-- modify the action to point to the intended endpoint -->
+        <form class="attack-form"
+              method="POST" name="diff-form"
+              action="IDOR/diff-attributes"
+              enctype="application/json;charset=UTF-8">
+            <input name="attributes" type="text" />
+            <input name="Submit Diffs" value="Submit Diffs" type="submit" />
+        </form>
 
         <!-- do not remove the two following div's, this is where your feedback/output will land -->
         <div class="attack-feedback"></div>
@@ -104,22 +101,21 @@
     which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
     <div class="adoc-content" th:replace="doc:IDOR_viewOwnAltPath.adoc"></div>
     <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
-        <div class="lessonContent">
-            <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
-            <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
-            <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
+        <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
+        <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
+        <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
 
-            <!-- modify the action to point to the intended endpoint -->
-            <form class="attack-form" accept-charset="UNKNOWN"
-                  method="POST" name="form"
-                  action="/WebGoat/IDOR/profile/alt-path"
-                  enctype="application/json;charset=UTF-8">
-                <div class="adoc-content" th:replace="doc:IDOR_inputAltPath.adoc"></div>
-                <input name="url" value="WebGoat/" type="text"/>
-                <input name="submit" value="Submit" type="SUBMIT"/>
-            </form>
-        </div>
+        <!-- modify the action to point to the intended endpoint -->
+        <form class="attack-form" accept-charset="UNKNOWN"
+              method="POST" name="form"
+              action="/WebGoat/IDOR/profile/alt-path"
+              enctype="application/json;charset=UTF-8">
+            <div class="adoc-content" th:replace="doc:IDOR_inputAltPath.adoc"></div>
+            <input name="url" value="WebGoat/" type="text"/>
+            <input name="submit" value="Submit" type="SUBMIT"/>
+        </form>
         <!-- do not remove the two following div's, this is where your feedback/output will land -->
         <div class="attack-feedback"></div>
         <div class="attack-output"></div>
@@ -133,23 +129,23 @@
     which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
     <div class="adoc-content" th:replace="doc:IDOR_viewOtherProfile.adoc"></div>
     <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
-        <div>
-            <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
-            <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
-            <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
+        <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
+        <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
+        <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
 
-            <!-- modify the action to point to the intended endpoint -->
-            <form class="attack-form" accept-charset="UNKNOWN" id="view-other"
-                  method="GET" name="view-other-profile"
-                  action="/WebGoat/IDOR/profile"
-                  enctype="application/json;charset=UTF-8">
-                <script th:src="@{/plugin_lessons/plugin/IDOR/js/idor.js}" />
+        <!-- modify the action to point to the intended endpoint -->
+        <form class="attack-form" accept-charset="UNKNOWN" id="view-other"
+              method="GET" name="view-other-profile"
+              action="/WebGoat/IDOR/profile"
+              enctype="application/json;charset=UTF-8">
+            <script th:src="@{/plugin_lessons/plugin/IDOR/js/idor.js}" />
 
-                <input name="View Profile" value="View Profile" type="submit" />
+            <input name="View Profile" value="View Profile" type="submit" />
+
+        </form>
 
-            </form>
-        </div>
         <!-- do not remove the two following div's, this is where your feedback/output will land -->
         <div class="attack-feedback"></div>
         <div class="attack-output"></div>
@@ -158,23 +154,22 @@
 
     <div class="adoc-content" th:replace="doc:IDOR_editOtherProfile.adoc"></div>
     <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
-        <div>
-            <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
-            <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
-            <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
+        <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
+        <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
+        <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
 
-            <!-- modify the action to point to the intended endpoint -->
-            <form class="attack-form" accept-charset="UNKNOWN" id="edit-other"
-                  method="GET" name="edit-other-profile"
-                  action="/WebGoat/IDOR/profile"
-                  enctype="application/json;charset=UTF-8">
-                <script th:src="@{/plugin_lessons/plugin/IDOR/js/idor.js}" />
+        <!-- modify the action to point to the intended endpoint -->
+        <form class="attack-form" accept-charset="UNKNOWN" id="edit-other"
+              method="GET" name="edit-other-profile"
+              action="/WebGoat/IDOR/profile"
+              enctype="application/json;charset=UTF-8">
+            <script th:src="@{/plugin_lessons/plugin/IDOR/js/idor.js}" />
 
-                <input name="View Profile" value="View Profile" type="submit" />
+            <input name="View Profile" value="View Profile" type="submit" />
 
-            </form>
-        </div>
+        </form>
         <!-- do not remove the two following div's, this is where your feedback/output will land -->
         <div class="attack-feedback"></div>
         <div class="attack-output"></div>
diff --git a/webgoat-lessons/sql-injection/src/main/resources/plugin/SqlInjection/html/SqlInjection.html b/webgoat-lessons/sql-injection/src/main/resources/plugin/SqlInjection/html/SqlInjection.html
index 6d20fe91a..b0c68efbc 100644
--- a/webgoat-lessons/sql-injection/src/main/resources/plugin/SqlInjection/html/SqlInjection.html
+++ b/webgoat-lessons/sql-injection/src/main/resources/plugin/SqlInjection/html/SqlInjection.html
@@ -2,212 +2,212 @@
 
 <html xmlns:th="http://www.thymeleaf.org">
 
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_plan.adoc"></div>
-	</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_plan.adoc"></div>
+</div>
 
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content1.adoc"></div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content2.adoc"></div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content3.adoc"></div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content4.adoc"></div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content5.adoc"></div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-        <!-- include content here. Content will be presented via asciidocs files,
-        which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content5a.adoc"></div>
-		<div class="attack-container">
-			<!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
-			<div id="lessonContent">
-                <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
-                <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
-                <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
-				<form class="attack-form" accept-charset="UNKNOWN" 
-					method="POST" name="form"
-					action="/WebGoat/SqlInjection/attack5a"
-					enctype="application/json;charset=UTF-8">
-					<table>
-						<tr>
-							<td>Account Name:</td>
-							<td><input name="account" value="" type="TEXT" /></td>
-							<td><input
-							name="Get Account Info" value="Get Account Info" type="SUBMIT"/></td>
-						</tr>
-					</table>
-				</form>
-			</div>
-			<!-- do not remove the two following div's, this is where your feedback/output will land -->
-			<div class="attack-feedback"></div>
-			<div class="attack-output"></div>
-			<!-- ... of course, you can move them if you want to, but that will not look consistent to other lessons -->
-		</div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-        <!-- include content here. Content will be presented via asciidocs files,
-        which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content5b.adoc"></div>
-		<div class="attack-container">
-			<!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
-			<div id="lessonContent">
-                <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
-                <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
-                <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
-				<form class="attack-form" accept-charset="UNKNOWN" 
-					method="POST" name="form"
-					action="/WebGoat/SqlInjection/attack5b"
-					enctype="application/json;charset=UTF-8">
-					<table>
-						<tr>
-							<td>Name:</td>
-							<td><input name="userid" value="" type="TEXT" /></td>
-							<td><input
-							name="Get Account Info" value="Get Account Info" type="SUBMIT"/></td>
-							<td></td>
-						</tr>
-					</table>
-				</form>
-			</div>
-			<!-- do not remove the two following div's, this is where your feedback/output will land -->
-			<div class="attack-feedback"></div>
-			<div class="attack-output"></div>
-			<!-- ... of course, you can move them if you want to, but that will not look consistent to other lessons -->
-		</div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content6.adoc"></div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-        <!-- include content here. Content will be presented via asciidocs files,
-        which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content6a.adoc"></div>
-		<div class="attack-container">
-			<!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
-			<div id="lessonContent">
-                <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
-                <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
-                <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
-				<form class="attack-form" accept-charset="UNKNOWN" 
-					method="POST" name="form"
-					action="/WebGoat/SqlInjection/attack6a"
-					enctype="application/json;charset=UTF-8">
-					<table>
-						<tr>
-							<td>Name:</td>
-							<td><input name="userid_6a" value="" type="TEXT" /></td>
-							<td><input
-							name="Get Account Info" value="Get Account Info" type="SUBMIT"/></td>
-							<td></td>
-						</tr>
-					</table>
-				</form>
-			</div>
-			<!-- do not remove the two following div's, this is where your feedback/output will land -->
-			<div class="attack-feedback"></div>
-			<div class="attack-output"></div>
-			<!-- ... of course, you can move them if you want to, but that will not look consistent to other lessons -->
-		</div>
-		<div class="attack-container">
-			<!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
-			<div id="lessonContent">
-                <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
-                <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
-                <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
-				<form class="attack-form" accept-charset="UNKNOWN" 
-					method="POST" name="form"
-					action="/WebGoat/SqlInjection/attack6b"
-					enctype="application/json;charset=UTF-8">
-					<table>
-						<tr>
-							<td>Password:</td>
-							<td><input name="userid_6b" value="" type="TEXT" /></td>
-							<td><input
-							name="Check Dave's Password:" value="Check Password" type="SUBMIT"/></td>
-							<td></td>
-						</tr>
-					</table>
-				</form>
-			</div>
-			<!-- do not remove the two following div's, this is where your feedback/output will land -->
-			<div class="attack-feedback"></div>
-			<div class="attack-output"></div>
-			<!-- ... of course, you can move them if you want to, but that will not look consistent to other lessons -->
-		</div>
-		
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content7.adoc"></div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content8.adoc"></div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content9.adoc"></div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content10.adoc"></div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content11.adoc"></div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content12.adoc"></div>
-	</div>
-	<div class="lesson-page-wrapper">
-        <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
-		<!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
-		which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
-		<div class="adoc-content" th:replace="doc:SqlInjection_content13.adoc"></div>
-	</div>	
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content1.adoc"></div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content2.adoc"></div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content3.adoc"></div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content4.adoc"></div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content5.adoc"></div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content5a.adoc"></div>
+    <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
+        <!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
+
+        <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
+        <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
+        <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
+        <form class="attack-form" accept-charset="UNKNOWN"
+              method="POST" name="form"
+              action="/WebGoat/SqlInjection/attack5a"
+              enctype="application/json;charset=UTF-8">
+            <table>
+                <tr>
+                    <td>Account Name:</td>
+                    <td><input name="account" value="" type="TEXT"/></td>
+                    <td><input
+                            name="Get Account Info" value="Get Account Info" type="SUBMIT"/></td>
+                </tr>
+            </table>
+        </form>
+        <!-- do not remove the two following div's, this is where your feedback/output will land -->
+        <div class="attack-feedback"></div>
+        <div class="attack-output"></div>
+        <!-- ... of course, you can move them if you want to, but that will not look consistent to other lessons -->
+    </div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content5b.adoc"></div>
+    <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
+        <!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
+        <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
+        <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
+        <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
+        <form class="attack-form" accept-charset="UNKNOWN"
+              method="POST" name="form"
+              action="/WebGoat/SqlInjection/attack5b"
+              enctype="application/json;charset=UTF-8">
+            <table>
+                <tr>
+                    <td>Name:</td>
+                    <td><input name="userid" value="" type="TEXT"/></td>
+                    <td><input
+                            name="Get Account Info" value="Get Account Info" type="SUBMIT"/></td>
+                    <td></td>
+                </tr>
+            </table>
+        </form>
+
+        <!-- do not remove the two following div's, this is where your feedback/output will land -->
+        <div class="attack-feedback"></div>
+        <div class="attack-output"></div>
+        <!-- ... of course, you can move them if you want to, but that will not look consistent to other lessons -->
+    </div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content6.adoc"></div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content6a.adoc"></div>
+    <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
+        <!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
+        <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
+        <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
+        <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
+        <form class="attack-form" accept-charset="UNKNOWN"
+              method="POST" name="form"
+              action="/WebGoat/SqlInjection/attack6a"
+              enctype="application/json;charset=UTF-8">
+            <table>
+                <tr>
+                    <td>Name:</td>
+                    <td><input name="userid_6a" value="" type="TEXT"/></td>
+                    <td><input
+                            name="Get Account Info" value="Get Account Info" type="SUBMIT"/></td>
+                    <td></td>
+                </tr>
+            </table>
+        </form>
+
+        <!-- do not remove the two following div's, this is where your feedback/output will land -->
+        <div class="attack-feedback"></div>
+        <div class="attack-output"></div>
+        <!-- ... of course, you can move them if you want to, but that will not look consistent to other lessons -->
+    </div>
+    <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
+        <!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
+        <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
+        <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
+        <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
+        <form class="attack-form" accept-charset="UNKNOWN"
+              method="POST" name="form"
+              action="/WebGoat/SqlInjection/attack6b"
+              enctype="application/json;charset=UTF-8">
+            <table>
+                <tr>
+                    <td>Password:</td>
+                    <td><input name="userid_6b" value="" type="TEXT"/></td>
+                    <td><input
+                            name="Check Dave's Password:" value="Check Password" type="SUBMIT"/></td>
+                    <td></td>
+                </tr>
+            </table>
+        </form>
+
+        <!-- do not remove the two following div's, this is where your feedback/output will land -->
+        <div class="attack-feedback"></div>
+        <div class="attack-output"></div>
+        <!-- ... of course, you can move them if you want to, but that will not look consistent to other lessons -->
+    </div>
+
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content7.adoc"></div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content8.adoc"></div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content9.adoc"></div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content10.adoc"></div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content11.adoc"></div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content12.adoc"></div>
+</div>
+<div class="lesson-page-wrapper">
+    <!-- reuse this lesson-page-wrapper block for each 'page' of content in your lesson -->
+    <!-- include content here, or can be placed in another location. Content will be presented via asciidocs files,
+    which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
+    <div class="adoc-content" th:replace="doc:SqlInjection_content13.adoc"></div>
+</div>
 
 </html>
\ No newline at end of file
diff --git a/webgoat-lessons/xxe/src/main/resources/plugin/XXE/html/XXE.html b/webgoat-lessons/xxe/src/main/resources/plugin/XXE/html/XXE.html
index 918cc0e0b..06d790ec8 100644
--- a/webgoat-lessons/xxe/src/main/resources/plugin/XXE/html/XXE.html
+++ b/webgoat-lessons/xxe/src/main/resources/plugin/XXE/html/XXE.html
@@ -20,6 +20,8 @@
     <div class="adoc-content" th:replace="doc:XXE_simple.adoc"></div>
     <!-- if including attack, reuse this section, leave classes in place -->
     <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
+        <!-- using attack-form class on your form, will allow your request to be ajaxified and stay within the display framework for webgoat -->
         <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
         <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
         <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
@@ -69,6 +71,7 @@
     which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
     <div class="adoc-content" th:replace="doc:XXE_changing_content_type.adoc"></div>
     <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
         <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
         <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->
@@ -128,6 +131,7 @@
     which you put in src/main/resources/plugin/lessonplans/{lang}/{fileName}.adoc -->
     <div class="adoc-content" th:replace="doc:XXE_blind_assignment.adoc"></div>
     <div class="attack-container">
+        <div class="assignment-success"><i class="fa fa-2 fa-check hidden" aria-hidden="true"></i></div>
         <!-- using attack-form class on your form will allow your request to be ajaxified and stay within the display framework for webgoat -->
         <!-- you can write your own custom forms, but standard form submission will take you to your endpoint and outside of the WebGoat framework -->
         <!-- of course, you can write your own ajax submission /handling in your own javascript if you like -->