If a developer forgot to escape the markup at all, then a user could enter... and do anything they wanted. 네, 그게 제 요점입니다. That is why I want the sandbox to display a severe security warning if the developer has forgotten to escape it.