Could inject script from URL hash of browser.