User profile widget runs HTML code

Hi,

At the moment, it seems that it's possible to input HTML code as the biography for a user, and that code will run and display when the user's profile is accessed. Obviously this isn't really ideal, so is there a way to remove HTML characters from the biography (or other profile fields)before displaying it? I believe this is the User Profile widget.