in reply to Tag-Stripper is Insecure

iirc, something like  1 while {code to strip tags here} would do the trick.
But as you say, "duh".