For cross-site scripting (CWE-79), suppose that "fname" is only expected to be a
simplified data file containing multiple pre-formatted HTML messages. It is assumed
that the file only contains the <b>, <u>, and <i> HTML tags. Any other tag would
violate the intended structure of the message file. If the program has allowed attackers