Good point. I guess I'm in agreement with tfa here - if special entities are ok, escape output. I don't think I want to allow a greater than sign in a "first na

Good point. I guess I'm in agreement with tfa here - if special entities are ok, escape output. I don't think I want to allow a greater than sign in a "first name" field, but it might be perfectly valid in a text field. And if that field is text, not hypertext, escaping output seems sane. Maybe only where html is expected - say in the html part of an email, while the text part just uses a proper encoding.