I thought that you could still invoke these cross site scripting programs by including an image tag, or providing an anchor tag that when followed, would activate the program in the context of the clicker.
