Hacker News Reader

This will stop embedding it in <script> but why couldn't the attacking website do the same with eval and substring?

Because you cannot issue cross-domain AJAX calls, the attacker does not have access to the response body as a string that can be manipulated.

Oh duh, I'm dumb.