Hacker News Reader

Yeah, escaping entities when rendering, using prepared statements in the database. It's not rocket science.

Or, you know, using ordinary SGML validation which has the capability to block disallowed elements since 1986.

amen