You do know about href exploits, right?