the editor of the html5 recommendation has written that "html does not ever have a markup injection vulnerability." that working group simply doesn't understand the problem that you guys are living with every day, so they're not at all motivated to try to correct it.