It's also a useful lesson for people thinking about security. When something that is not actually HTML can be interpreted in a browser as HTML, there is a big p

It's also a useful lesson for people thinking about security. When something that is not actually HTML can be interpreted in a browser as HTML, there is a big potential security hole. For example: At one point, I sanitized incoming user content by parsing it as HTML and nuking almost all markup (I allowed links and italics to pass through). THEN I realized this wasn't good enough, because Firefox was parsing unclosed image tags as though they were closed. The (strict) parser I was using would pass through a user's unclosed image tag as plain text, but Firefox would load it as an image. An attacker could have used that to not only collect visitor IPs (by loading an image on his server) but also to do various things with Javascript -- an image tag can include an onload attribute. (I have no idea if Firefox still works this way, it was about five years ago.)