HTML has to be escaped

It is possible to use plain html in a query or when entering tags or comments, and this html will not be escaped later (see, e.g., http://interface.mace-project.eu/_por...) --> danger of cross-scripting!