From http://www.thisislegal.com/tutorials/7 script injection