this code is vulnerable to script injection attacks and would probably be flagged during a security review.  You need to ensure that the value argument does not contain any HTML characters.