Potential Cross-Site Scripting Payload

there should be no place in the app where HTML is accepted and therefore not run. Where needed it will escape syntax properly.