The text to escape.
The escaped text.
The engine does not escape by default. Unless the engine runs with
escape: true, both {{name}} and {{{name}}} insert values as-is, so
run anything that comes from users through escapeHtml before binding it.
With escape: true, {{name}} values go through this function and
{{{name}}} values stay raw.
HTML-escape text, identically in all three engines:
&<>"'become&<>"'. The result is safe in element content and in quoted attribute values. Text without special characters is returned unchanged.