I'm not sure how I let this slip through. But, the operators found it.
We need to sanitize the entries before posting:
https://code.google.com/p/google-caja/wiki/RunningCaja
https://code.google.com/p/google-caja/wiki/PipelineConfiguration
I'm just glad I was able to fix it here before an
tag was added in an entry ... it would have looked like a 90's MySpace page.
I need to do checks at the server too.