This isn't about what html escaping is or how it's done, but if there's an established best practice abou