Hi, that's right. Some sites protect html injection. Twitter protects their site very well, but if you use http tunneling they can't do nothing as you can modify X- headers.
Interesting, could you explain what you mean by http tunneling and how it can bypass protection against html injection?