This script should run because XSS protection is disabled.