>>6
replacing them all with & works just fine in xhtml.

>>7
body can have a class attribute in xhtml.
here are the problems with your xhtml code and how to fix them:

1. <, >, and & must be escaped, even in javascript. you have an unescaped < in your script tag. replace it with <.
2. you can't have a body tag inside a body tag. also, you have two body start tags but only one closing tag. remove one of the start tags.
3. there is no attribute onLoad. use onload instead.
4. all tr and td tags must be closed. the first tr in the new thread form and the second td in that tr are unclosed. close them.

if you want to do tripcodes you'll probably have to implement crypt yourself.