script tag inject demo