("<3") would likely pass the validation step, since it is commonly used. However, it
cannot be directly inserted into the web page because it contains the "<" character, which
would need to be escaped or otherwise handled. In this case, stripping the "<" might
reduce the risk of XSS, but it would produce incorrect behavior because the emoticon