https://jdnash.com/2011/01/yet-another-microsoft-ie-cross-site-scripting-bug/