That too is true. Unfortunitly, that included me for a long time.

<script type="text/javascript">alert("remember when scripting attacks worked?");</script>