[acdha]

If I can inject JavaScript into the page I can also inject HTML with a big “Win a free iPad click here!” link. JavaScript is the symptom, not the disease.