You simply never use string concatenation to produce HTML, CSS, JS, SQL, etc. Instead, use e.g. an HTML library that automatically escapes strings. Then you do

You simply never use string concatenation to produce HTML, CSS, JS, SQL, etc. Instead, use e.g. an HTML library that automatically escapes strings. Then you don't even have to think about it.