The editor of the HTML5 recommendation has written that "HTML does not ever have a markup injection vulnerability." That working group simply doesn't understand the problem that you guys are living with every day, so they're not at all motivated to try to correct it. 