Cross-site scripting attacks are usually ineffectual, but what if hackers put exploit code into barcodes or numberplates?