hey <script>alert(1)</script> or '<br>' foo bar