Don't do this on your domain. Have a separate domain for user content (and, if the content isn't public, better have many separate domains and distribute the co

Don't do this on your domain. Have a separate domain for user content (and, if the content isn't public, better have many separate domains and distribute the content between them; maybe even have a per-user domain). Browsers can be convinced that a particular resource is an html page even if the content-type is wrong.