Content-Type: text/plain; [...] <img dynsrc=javascript:alert()><font color=red>foo
The above is a legitimate RFC822 mail message in plain text. Ordinarily one would require an html mail message [Content-Type: text/html;] to parse html and scripting.
Internet Explorer seems to take no offense on Content-Types either - text/plain from a web server is happily rendered as HTML, if it contains valid tags.
Denis Jedig syneticon GbR
