I don't know if I am justified in worrying about this, but to me it would feel safer if HtmlEncode is the last thing we do, i.e. *after* string replaces, instead of *before*.