Security problem: user input is not being sanitised and passed directly to the browser.