Merge pull request #3942 from TheDZD/stop-being-chucklefucks-when-it-comes-to-user-input

Fixes Some HTML Chucklefuckery

code/modules/mob/living/carbon/human/emote.dm

@@ -851,4 +851,4 @@
 	set desc = "Sets an extended description of your character's features."
 	set category = "IC"
 
-	flavor_text = TextPreview(input(usr, "Please enter your new flavour text.", "Flavour text", null) as text)
+	update_flavor_text()

code/modules/mob/mob.dm

@@ -662,7 +662,7 @@ var/list/slot_equipment_priority = list( \
 	if (flavor_text && flavor_text != "")
 		var/msg = replacetext(flavor_text, "\n", " ")
 		if(lentext(msg) <= 40 || !shrink)
-			return "<span class='notice'>[msg]</span>"
+			return "<span class='notice'>[html_encode(msg)]</span>" //Repeat after me, "I will not give players access to decoded HTML."
 		else
 			return "<span class='notice'>[copytext_preserve_html(msg, 1, 37)]... <a href='byond://?src=\ref[src];flavor_more=1'>More...</a></span>"