<script>alert('hi');</script>