<script>alert('foo');</script>