Not to be offensive (please grin, while reading the following as well-meant but emphatic) ...

    Are you utterly MAD?

Unless you have sole and absolute control of any and all input devices that might be able to use your form and thereafter assure that NO part of the the input is ever subject to an eval or system call or (...the list goes on and on), you're just begging for trouble... anything from user_error on the .html input to knowledgeable exploits!