A JavaScript security flaw

No. You have to escape <, >, &, etc. in <script> tags.