tries to strip <script> tags. However, this action is incomplete, so the implemented
security policy is "a line in a message may not contain '<script>' at the beginning."
There is also an intended control sphere with respect to buffer overflows. One line 4, the
programmer assumes that the strcat() will not write outside the boundaries of fname.