I still think all user input should be treated as potentially dangerous and html sanitised before it's rendered.