Pretty unsafe: <script>