<script>alert('pwned!')</script>