Why aren't we allowed to use HTML? Like you said, it's a huge security issue. http://www.cgisecurity.com/articles/xss-faq.shtml That article should outline some reasons why, if you are interested.