3 ms·

Or maybe just treat strings and user input as opaque objects and leave it to the libraries to escape them.