XSS script tag: needs verification and added remark