What's inside <script>alert('hi')</script>