Why do we strip these characters? They might be valid. And why on input?Shouldn't we be (html) encoding on output?