Interestingly, html/template does actually handle some stuff like this. Pass html in a string as a field into html/template, and it'll escape all the html auto

Interestingly, html/template does actually handle some stuff like this. Pass html in a string as a field into html/template, and it'll escape all the html automatically. In order to get the html to actually render, you have to pass it in as a `template.HTML`. There are variants of the `HTML` type for different places, including html attributes and javascript code.