HTML escape characters are not working for the title of
new topics, in the little confirm window that comes up
right after a new topic is created.
the template toolkit can escape out html by saying
[% name | html %]
In general all of the templates needs to be gone over,
and looked at from an html escape perspective.