This is why you sanitize user input: Chat hacked live by XSS/HTML code injection, hilarity ensues