[xavel]

Not to worry, but sanitizing input literally takes no more than one additional function call (at least for php/ruby/python/perl/nodejs/java/c#/ocaml).

I can understand that this might be a hassle if you've written this app in COBOL, or some other word-heavy language. In which case, my most sincere condolences.

[derekchiang]

In fact I wrote this in Erlang :P

[xavel]

Pretty impressive, I didn't know Erlang was suitable for web programming. :-)

Nonetheless, you really should make sure that input is sanitized. XSS attacks are a nasty thing.