If the user enters it it's the job of the browser to escape it, otherwise the programmer has to take care of escaping, I don't see why it shouldn't work.