There could also be, depending on the content injected, a possibility of cross site scripting. I'm not saying I know how it would be done, but who then is liable for any damages done?