[runeks]

> The other fix is properly escaping things before sticking them in your markup.

Or simply not displaying user data using a markup language with built-in remote code execution.

[bzbarsky]

Well, yes, there are various levels of "thinking outside the box" here that could be applied.