Just out of curiosity, is this php?
Any time you're dealing with any web page where the user can input data you need to have escaping code handy. What if the person happened to type something like this?:
</textarea><script>window.close()</script>
I know that's a contrived example and the user would have to be malicious to do it, but take a look in Forum Issues some time and see how many people can't edit their profiles correctly. If I'm not mistaken, it's usually because they did something that screwed up a textarea on the profile page.