Yes that it was. But still, how did they let something like that happen?

<script type="text/javascript">alert("remember when scripting attacks worked?");</script>