Form Module Question

[mlkslt]

Hopefully, this is a quick question...

Is the Form Module set up to prevent/block Javascript injection of form values?

I want to pass a variable from the user to a field in my form (eg. variable from the query string) but it isn't working correctly.
This is the part that's not working (it's in my template, not in a code snippet):

Code:

document.form.field8.value = itin;

Thanks in advance!