XSS is not allowed.