Fixed. Someone tried their hand at a Javascript cross-site scripting attack. Let me know if you see any more.