XSS injection is possible.