1. A method for detecting malicious code insertion in data, the method comprising: detecting, at an application executing using a processor and a memory in a data processing system, a script that has been inserted in a mix of code and content; removing, to form a remaining script structure, from the script a content-related portion, the content-related portion referring to the content in the mix; selecting, from the remaining script structure, a code construct; replacing, to form a normalized construct, the code construct with an alphanumeric string; determining whether the normalized construct matches, within a tolerance, a second normalized construct in a corpus of normalized scripts; and concluding, responsive to the normalized construct matching the second normalized construct within the tolerance, that the script is malicious.