Oh. Cross-site scripting ballache