what does everyone think - should they get escaped, or should we test for them and alert users a la html format bodies?