Javascript can be injected into the page via nick changes.