JavaScript code injection without a