Should escape < and > and /

[robrich]

I'm trying to create a badge that says "<script>" and "</script>" and the site yields 503s whenever I include < or > or / -- even if I url-encode and/or http-encode the parameter. I suspect many non-[a-zA-Z0-9] have a similar concern.