Oh, wow - you're right! It does work, and trivially so. That is, I created chr(3), opened it in a text editor, and copy/pasted. Poof! No longer in the cat.

I then put sample command line in HTML, with an embedded  . Yep, copied and pasted just fine.

Which means my SOP for dealing with untrusted text isn't anywhere near as good as I thought it would be.

Thanks for pointing that out!