Ah! I was actually struggling to understand how inputs had anything to do with it. I thought the input was being rendered with some pre-populated/injected value

Ah! I was actually struggling to understand how inputs had anything to do with it. I thought the input was being rendered with some pre-populated/injected value that in this case was the script. <input><script.../></input> Then again, if they were able to inject something into the input, chances are they could inject it anywhere, so as you said it has nothing to do with input fields. Thanks for the clarification.