Comment by alanh

"The message format is not dangerous. It is the message viewers that are dangerous in this particular regard."

Ah, I see. We should allow HTML but display it as plain text.