[re6tor]

Thanks for your feedback! I see input sanitation as a double-edged sword: it could potentially prevent some misuse of the service (since it's 100% anonymous), but then ultimately you're the "owner" of your keys (though they're in reality public) and you should be able to write whatever you want in them.

I guess this argument could also be applied to Pastebin? Should it be returning raw HTML if asked to?

[fathyb]

The "Content-Type" HTTP header is "text/html; charset=utf-8", you could make it "text/plain; charset=utf-8" to prevent HTML from being parsed.

[re6tor]

That makes total sense, cheers!