506 tags in question list

I think the only danger here would be if this method accepted user input, wouldn't it? How would just unescaping HTML allow XSS attacks?