Doesn't strip script tags or anything; lots of nasty stuff you could do with this. Somebody should notify them.

https://www.maybank2u.com.my/mbb/m2u/jsp/common/mbbReceipt.j...

didn't notice that right away, nice catch :)