damieng

I think then you are missing the point of .NET with it's sandboxed VM, code access security, type safety, bounds checking, pointerless operations, garbage collection, trust levels...

[)amien
 

Your right, lets just add Html Encoding at the CLR level. Encode all strings!

Apples to Oranges.