new post. javascript cross site scripting.