Why escape-on-input is a bad idea | Hacker News Reader