Even the simple script:
CODE
<?php echo "HELLO WORLD"; ?>
results in:
CODE
HELLO WORLD
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("xxxxx");
pageTracker._trackPageview();
} catch(err) {}</script>
<script type="text/javascript">
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
</script>
<script type="text/javascript">
try {
var pageTracker = _gat._getTracker("xxxxx");
pageTracker._trackPageview();
} catch(err) {}</script>
being returned from the server.
Getting the HTML/CSS validation to pass is not the main point of this issue; rather, I see it as a fundamental flaw --- besides other concerns, I expect the pages I upload to my site to be sent, verbatim, back through HTTP. Another fact is that many users simply do _not_ want their actions tracked, without prior notice, as they browse my site, and neither do I; to have this fragment being injected into the pages of my site is, to them, a dishonest and suspicious practice that I, the site owner, do not want to have the responsibility of bearing. Please fix this.