It doesn't require supporting active content in the mail reader. (And
HTML *is* active content; anything that results in any sort of outgoing
network connection, such as <img> tags, is inherently active content.
If you disable all of that, you get a stripped version of HTML that may
possibly be mostly safe unless you use Microsoft's HTML rendering
engine, but almost no one does that.)
You can disallow (or restrict in various ways) going outside the message
to follow links. Graphics get referenced as other body parts inside
a multipart/related bundle. After all, if you're just using HTML as a
handy way to bundle links to external content (and you don't care that
much about formatting graces), it's not much of an advantage over using
text and saying "come look at the picture of my dog at
<http://www.example.com/mydoggie.html>".
(For an example of a webmail interface that does that pretty reasonably,
see <http://www.squirrelmail.org>.)
--
bill(_at_)carpenter(_dot_)ORG (WJCarpenter) PGP 0x91865119
38 95 1B 69 C9 C6 3D 25 73 46 32 04 69 D6 ED F3