All this info is great. But here is another text area question:
I want users to be able to enter number signs, single quotemarks, double quotemarks and ampersands.
I think I understand what the post is saying but do I have to create a <cfset post = replace...> for every possible HTML tag and every keyboard entry except for letters?
Is there a good book out there on this stuff.