remove <script> for security reasons