See also: https://www.mysociety.org/2011/08/11/mobile-operators-breaki... where O2 stripped JS comments, without checking to see whether those comment delimiters were part of a string.