Removed document.write and changed the OA_show function and handled the case for response containing script tags

Changes:-
In spc.php, the JavaScript object that was exposed to the browser was an Array type, It must be an Object type and the Object should be in the window scope. I have taken care of these things with the changes.

In spcjs.php, Removed unnecessary '&amp;' and replaced with '&' as it won't make a difference and Instead of directly dumping the response with document.write, I am creating a script tag and inserting it into the head like <script src="spc.php link ">. So it will fetch the response and store it in the object which will be window scoped. Now publisher will pass the id as well as zone name with show function and show function will directly dump the response by doing document.getElementById.innerHTML on that particular HTML element.

Handled the case when response contains script tags. Thanks for pointing it out.