Subject: | Escape HTML in testserver and handle embedcode appropriately |
CGI doesn't escape HTML by default so everything has to be escaped
before feeding it to CGI. Depending on whether there is a valid
scenario for the use of embedcode which isn't a valid HTML fragment we
should change the & when using embedcode as HTML.