I have a textbox in a form which needs to accept input with HTML tags.

Submitting input with HTML tags in makes the app throw a `HttpRequestValidationException`, unless we use `HttpUtility.HtmlEncode`. Easy so far.

However, the input may also contain symbols, such as the 'degrees' symbol (°). When these are also HTML encoded, they become numeric escape codes, in this example `&#176;`. These codes also cause `HttpRequestValidationException` to be thrown, but the question is why?

I can't see why numeric escape codes are thought of as potentially dangerous, especially as `&deg;` works as input just fine.

I seem to be stuck, as leaving the input as-is fails due to the tags, and HTML encoding the input fails due to the numeric escapes. My solution so far has been to HTML encode, then regex replace the escape sequences with their HTML decoded forms, but I'm not sure if this is a safe solution, as I assume the escape sequences are seen as dangerous for a reason.