> Do it on the client side? Not practical given a large amount of documents. > Do it in a sandbox and have aggressive timeouts. Sure! I was just replying to

> Do it on the client side? Not practical given a large amount of documents. > Do it in a sandbox and have aggressive timeouts. Sure! I was just replying to this: > the danger of passing anything derived from user input into the TEMPLATE side of a templating engine. Why in the world would you ever do that?!?