omg <script>alert('CAT1')</script>