I don't grok why they'd even try to inject their code into a webpage you requested. Why not simply create a separate page that you see BEFORE, that you read and

I don't grok why they'd even try to inject their code into a webpage you requested. Why not simply create a separate page that you see BEFORE, that you read and acknowledge receiving, and then finish sending the requested page?