"<sCrIpT>" or tags such as IMG that accept javascript in attributes, then the crossover
point happens after line 8. This is because the check for "<script>" tags is an
incomplete blacklist (CWE-184), so the line variable in line 9 violates the expected
property "contains no script." The trigger point happens in line 9, when the XSS is sent