Testing that this is escaped: <script>