If you're including the input text be sure to run it through several fairly severe cleansings. You may want to strip any javascript, forms, ssi, applets and other goodies not desired. In fact if you're just looking for text perhaps stripping all tag might help.

$textin =~ s/<[^>]*>//sg;   ## strip normal tags
$textin =~ s/^[^>]*>//sg;   ## strip sneaky left over stuff
$textin =~ s/<[^<]*$//sg;   ## strip sneaky left over stuff
[download]

That should get rid of most attacks to your script.
Of course you can always just strip forms, ssi, etc. and leave normal tags alone. It all depends on how severe you feel you need to be -- or can afford.

Claude