I feel like I’m posting a spoiler here, but... Think what happens if the user’s “e-mail address” happens to start with:

    "/><script>