Comment by fathyb

The "Content-Type" HTTP header is "text/html; charset=utf-8", you could make it "text/plain; charset=utf-8" to prevent HTML from being parsed.