Explain the script tag injection