added script tags to unsafe element replacement