script injection attacks in one page JavaScript apps

...is something that came up in conversation at a team outing Friday. Just hand in a script tag in a form field. Can you application deal with it? Yikes.