an class="token variable">model</span><span class="token punctuation">.</span><span class="token variable">firstName</span><span class="token delimiter punctuation">}}</span></span> has joined the channel.
<span aria-hidden="true" class="line-numbers-rows"><a href="#C24_L1" id=C24_L1></a></span></code></pre>
<p>Now a malicious user simply needs to set their <code>firstName</code> to a string
containing HTML (like a <code>&lt;script&gt;</code> tag that sends private customer data
to their server, for example