watch characters

Here’s an example that would have been caught with a validator:

  <url prefix=" <" suffix=">"/>

Those need to be escaped.

Bruce