> where exactly are you expecting the attack vector to occur? between when you serialize the DOM you've built up and sent it across the wire? I'm expecting the

> where exactly are you expecting the attack vector to occur? between when you serialize the DOM you've built up and sent it across the wire? I'm expecting there to be some minor mismatch between what the serializer considers worth escaping, and what the parser considers to have some special meaning. > the DOM isn't useless on the server if you take that DOM that you've built up, serialize it and send it Exactly...?