It's not particularly well escaped, either - typing <s makes the cursor disappear, and if you paste in something like <script>alert('hi');</script> it get

It's not particularly well escaped, either - typing <s makes the cursor disappear, and if you paste in something like <script>alert('hi');</script> it gets executed.