I have a piece of JavaScript string, ing from an untrusted source, embedded inside of an onclick tag an