Right, but you seem to be talking about input -- the question was about output. I did get my answer, though -- output matters because it might be a different m

Right, but you seem to be talking about input -- the question was about output. I did get my answer, though -- output matters because it might be a different medium than input. So even if you sanitize HTML input, malicious VBA code could make it through that eventually ends up in an Excel report and gets executed (for example).