Sure, it will be just a race between the developer and the attacker and both will be able to create solution as complex as it worth it for each of them. If we g

Sure, it will be just a race between the developer and the attacker and both will be able to create solution as complex as it worth it for each of them. If we go deeper, we can combine words from the question with some other elements between them, like images or even divs with some content inside.