1. A computer usable program product comprising a computer readable storage device including computer usable code for detecting malicious code insertion in data, the computer usable code comprising: computer usable code for detecting, at an application executing using a processor and a memory in a data processing system, a script that has been inserted in a mix of code and content; computer usable code for removing, to form a remaining script structure, from the script a content-related portion, the content-related portion referring to the content in the mix; computer usable code for selecting, from the remaining script structure, a code construct, wherein the code construct comprises a function call, and wherein the function call comprises any call to any function in the remaining script structure; computer usable code for replacing, to form a normalized construct, the code construct with an alphanumeric string; computer usable code for determining whether the normalized construct matches, within a tolerance, a second normalized construct in a corpus of normalized scripts; and computer usable code for concluding, responsive to the normalized construct matching the second normalized construct within the tolerance, that the script is malicious.