The filter has another purpose, which is to filter out potentially harmful HTML. This includes script, which has surprising power to cause mischief. There was an incident a few months ago in which somebody posted script in an item description on eBay that "climbed out" of the description block and rewrote all the links on the page to point to a phishing site. An item description is analogous to a message here, and while the potential for mischief is relatively small on the individual message pages, it can climb up from the message page into the main interface and potentially mess with the menu buttons and other main links.

Script can do other things like read cookies, and in some poorly designed BBS software you can actually pick up usernames and authentication codes from cookies. In one white-hat hacking test I verified that I could've penetrated the NY Times BBS and picked up administrator access. Dumb.

You wouldn't expect script to have anything to do with formatting, but it turns out that IE has a method of associating script with HTML elements through the 'style' attribute, and FireFox has a different method of doing something similar. So I also have to impose restrictions on what you can do with style.

Also, SCRIPT tags aren't the only way to inject script on to a page; it can also be done by associating it with an event like 'onclick' inside a tag, so my filter has to also scrub event handlers inside the tags.

I've looked around, and mine is the most elaborate filter in use on a BBS anywhere (among those that are effective; I've seen many that I could cut through like a knife through butter), and because of that you get to do more with HTML here than most other places. Many boards just throw up their hands and scrub out all HTML, or allow you only a few tags like I and B formatting, and IMG and A tags.

So think of the glass as not half-empty, David, but half-full.