@markstory Or more appropriately: All user input and all stringish non-HTML values outputted (to avoid some characters breaking the HTML).