>Wrong. The guys who invented the protocol/language thought of that, of course. Thats just basic escaping, you know. Try typing "&" into a some box, e.g. the google search box. The browser will convert it to "%26amp;" and if you type "%26amp;", it will turn into "%2526amp;". So, unless the user was talking to the server directly with telnet or something, everything will be properly escaped and the server will get exactly what the user typed.

the google search box isn't a good example, since it uses utf-8...
make a form in a page that uses us-ascii as the charset and try typing æ and & # 230 ; (without the spaces, of course) into it. they'll both give you the exact same result.