The core of the test is that `<script>` and other potentially malicious tags are removed, including hacks like `<<script>`.