in reply to Re^2: CGI script security: putting untainted input into a qr//
in thread CGI script security: putting untainted input into a qr//

IIRC, IE will try to do the right thing (for its definition of the right thing). Even if you make it text/plain, I think it may render it as HTML if it looks like HTML.

Update: Just checked this, and yes it does. The following code, in s.txt, renders as HTML in IE.

<A HREF="/">Root</A> <IMG SRC="/logo.jpg">

--MidLifeXis