I don't want anyone to inject JavaScript into my apps. So, if it is possible to do something like the title, I try to write code to prevent this. But this seems too difficult, so I ask a question.