Sanitize HTML input before putting it in the database. Good grief that was stupid.