so, hoster doesn't escape anything the users provide, and is more concerned about CSS instead of JS?

And then their site broke as soon as I clicked a link